Unauthenticated attackers can manipulate privileged processes and take over code repositories through insecure permission configurations in GitHub Actions.
A critical CI/CD vulnerability called Cordyceps enables attackers to gain full control over repositories and compromise the supply chain of hundreds of open-source projects.
Invisible HTML comments in GitHub Issues could trick Claude Code AI into reading protected environment variables like ANTHROPIC_API_KEY due to insufficient restrictions on the Read tool.
