People often claim that open source is more secure, which is implied in this release. But the CodeCov breach that leaked any secrets provided to CI/CD pipelines [1] was done via a bash script available to anyone to read the code. The breach wasn't complex at all. It was just that nobody noticed for a long time that the bash uploader script sent all secrets to a random IP address.
It makes me wonder what the benefit really is to being open source. Is it just marketing?
It makes me wonder what the benefit really is to being open source. Is it just marketing?
https://about.codecov.io/security-update/