但根据 Wiz 客户事件响应团队的最新研究，攻击者正在利用这种盲目信任。 他们发现威胁行为者正在使用暴露的GitHub个人访问Token（PATs）来访问GitHub Action Secrets，并潜入云环境，然后大肆破坏。 Beauceron Security的David Shipley表示："根本问题是这些密钥存在于代码库中。

Multiple high-profile open-source projects, including those from Google, Microsoft, AWS, and Red Hat, were found to leak GitHub authentication tokens through GitHub Actions artifacts in CI/CD ...

A scan of billions of files from 13 percent of all GitHub public repositories over a period of six months has revealed that over 100,000 repos have leaked API tokens and cryptographic keys, with ...