TAG://#github

3 posts tagged #github

2026-04-08series: Charlotte MCP

> Anatomy of a GitHub Actions Supply Chain Attack Targeting MCP Repos

A pull request to my MCP server Charlotte led me to uncover a supply chain attack spanning 250+ repos, 64 sockpuppet accounts, and five phases of escalating access — all funneling GitHub OIDC tokens to a single organization.

#opensource (22)#security (7)#github (3)#supplychain

2026-03-10series: Guardrails

> Secrets, Agents, and .env Files

Your AI agent can read your environment variables. It can also commit them. Here's how to make sure it doesn't.

#github (3)#security (7)#ai (12)#beginners (2)

2026-03-09series: Guardrails

> Stop Letting Agents Push to Main

Your AI coding agent is one bad prompt away from force-pushing to production. Here's the five-minute fix.

#github (3)#devops (2)#ai (12)#beginners (2)