|
|
|
|
|
by ketzo
296 days ago
|
|
> While running the exploit, CodeRabbit would still review our pull request and post a comment on the GitHub PR saying that it detected a critical security risk, yet the application would happily execute our code because it wouldn’t understand that this was actually running on their production system. What a bizarre world we're living in, where computers can talk about how they're being hacked while it's happening. Also, this is pretty worrisome: > Being quick to respond and remediate, as the CodeRabbit team was, is a critical part of addressing vulnerabilities in modern, fast-moving environments. Other vendors we contacted never responded at all, and their products are still vulnerable. [emphasis mine] Props to the CodeRabbit team, and, uh, watch yourself out there otherwise! |
|