Contact
Educational demonstration

CI Secret Exposure via `pull_request_target`

A workflow that checks out untrusted pull-request code in a privileged context hands repository secrets to any fork.

Lab target · not a client engagement
Overview

pull_request_target runs in the context of the base repository, with access to secrets. The vulnerable workflow also checks out the pull request's head commit and runs npm install — executing attacker-controlled install scripts with a deploy token in scope.

Findings
critical
XV-DEMO-16 · Verified by test

Untrusted code executed with repository secrets

Description

The workflow checks out github.event.pull_request.head.sha and runs package install scripts under pull_request_target.

Impact

Any fork could exfiltrate the deploy token.

Recommendation

Build untrusted code under pull_request with no secrets; perform privileged steps in a separate workflow that never executes PR code.

medium
XV-DEMO-17 · Verified by test

No permissions: block for GITHUB_TOKEN

Description

Token permissions fall back to repository defaults.

Impact

A compromised step may be able to push code or modify releases.

Recommendation

Set permissions: read-all and grant writes per job only where needed.

low
XV-DEMO-18 · Verified by test

Actions referenced by mutable tag

Description

actions/checkout@v4 can change underneath you.

Impact

A compromised upstream tag changes what runs in the pipeline.

Recommendation

Pin actions to full commit SHAs and update them deliberately.

Outcome

Measured in the lab: a static checker flags all three issues in vulnerable.yml and none in fixed.yml. The commit SHAs pinned in the fixed workflow were checked against the upstream release tags (actions/checkout v4.2.2, actions/upload-artifact v4.6.2).

These workflows were analysed statically; they were not executed on GitHub, and no secret exfiltration was performed.

Reproduce

The lab code and tests for this case study live in labs/web2 of the Xevry website repository.

cd labs/web2npm installnode --test test/workflow.test.js

Files: labs/web2/workflows/vulnerable.yml · labs/web2/workflows/fixed.yml · labs/web2/src/workflowCheck.js

More case studies
Educational demo
Infrastructure

SSRF Validation and Metadata Exposure in a Link-Preview Service

A string-matching URL filter misses most ways of writing an internal address. Paired with permissive instance settings, that is a path to cloud credentials.

3 findings · 3 test-verifiedCase study
Educational demo
Web3

First-Depositor Inflation in an ERC-4626-Style Vault

A vault that prices shares from its own token balance lets an attacker capture the next deposit with a 1-wei position and a donation.

3 findings · 2 test-verifiedCase study
Educational demo
Web3

Cross-Function Reentrancy in a Staking Contract

A guarded withdraw function and an unguarded transfer function share state. The attacker re-enters the one nobody locked.

1 finding · 1 test-verifiedCase study
Start a conversation

Let's discuss your security needs.

Tell us what you're building. We'll respond with clear questions, an honest view of whether we're the right fit, and a scoped proposal if we are.

Discuss an Assessment Our Methodology