Finished scanning all the github projects in my venv for #zizmor vulnerabilities now scanning all the venv on my entire computer.
One vulnerability anywhere and I figure my machine is pwned
Probably just a few thousand opportunities, can't be that bad, can it
People got the message about #pwnRequest and have updated their code... sort of.
`pull_request_target: # zizmor: ignore[dangerous-triggers]`
I don't know, the security model is all maximum surprise, maybe it isn't possible to repro cache poisoning for reasons (maybe some other job needs caching)
Just in the venv for the app that scans the dependency tree for #zizmor flaws, there are 88 repos that I'd need to file Pull Request to fix my supply chain. This is going to take years.
(this runs zizmor against every repo for every dependency to find out who is likely to turn into a malicious artifact next)
If you run #zizmor on your on repo and fix the github actions there, you gain just about nothing if your entire dependency tree doesn't do the same. Malicious actors will stop targeting your app and target the 200+ softer targets in the dependency tree.