megamorf

I don't understand why anyone would still start a new software project in C today, given the long track record of mistakes developers can make in it.

I'd love to hear more about this; have you considered creating a blog post, gist or something similar about it?

Why is that horrific? To me it sounds like something desirable. Religion is a personal matter, as such it should not infringe on public spaces.

The exfiltrated environment variables contained these entries:

``` "POSTGRESQL_DATABASE": "(CENSORED)", "POSTGRESQL_HOST": "(CENSORED)", "POSTGRESQL_PASSWORD": "(CENSORED)", "POSTGRESQL_USER": "(CENSORED)", ```

The security researcher noticed that CodeRabbit runs linters against your code base and noticed that Rubocop was among the provided linters. Rubocop supports extensions that contain custom code, so he crafted an extension that exfiltrated the environment variables of the running Rubocop process when it linted the contents of his PR.

Howon, you can stop posting that canned response. It's not helping the discussion in any way and matches the lack of detail the other commenters have pointed out.

Never heard of the product and just had a look at the landing page. Immediately spotted a typo :D

> On Mac, Window and Linux

should be

> On Mac, Windows and Linux

Space goes after the comma, not in front of it.

Seconded, it’s really irritating

Doesn't this effectively render corporate CAs useless?

Unfortunately, it leaves a lot to be desired. I've actually had to do a fair bit of GH access reporting myself recently and I can recommend the GraphQL API as it allows you to properly list direct and indirect permissions on repositories (org + team + direct collaborator) that are alot harder to do with the REST API due to its inconsistent permissions model.