github-actions

BSides Lisbon·20 min

• BSides
• Hardware
• Date: 2025
• Location: Bsides

Luís Fontes

Luís Fontes examines [BSL2022] Are your github actions secure?.

CODE BLUE 2025·39 min

• CODE BLUE
• Red Team
• Date: 2025
• Location: Code Blue

Analysts investigate attack surfaces and defenses concerning [CB25]GHARF：GitHub Actions RedTeam Framework.

FIRST·23 min

• FIRST
• Supply Chain
• Date: 2025
• Location: First

Analysts investigate attack surfaces and defenses concerning Breaking the Build: How Attackers Abuse GitHub Actions.

fwd:cloudsec North America 2025·22 min

• FWD CLOUDSEC
• Supply Chain
• Date: 2025
• Location: Fwd Cloudsec

Presenters detail vulnerability discovery and exploitation in Not So Secret: The Hidden Risks of GitHub Actions Secrets.

Main Stage·42 min

• DEF CON
• Supply Chain
• Date: Aug 2025
• Location: Las Vegas

Aviad Hahami

Reconstructs the multi-stage CI/CD supply chain compromise of the popular tj-actions GitHub Action, detailing secret exfiltration and attacker tradecraft.

OWASP Foundation·32 min

• OWASP
• AppSec
• Date: 2025
• Location: Owasp

Stephen Giguere

Stephen Giguere analyzes Hacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?.

SEC-T 2025·30 min

• SEC T
• Policy
• Date: 2025
• Location: Sec T

Analyzes SEC-T 0x11: Simon Gerst - Attacking and defending GitHub Actions and evaluates key implications for security practitioners.

The Linux Foundation·36 min

• LINUX FOUNDATION
• Blue Team
• Date: 2025
• Location: Linux Foundation

Alex Ilgayev · Ronen Slavin

Investigates github Actions Security Landscape and evaluates key implications for security practitioners.

The Linux Foundation·41 min

• LINUX FOUNDATION
• Blue Team
• Date: 2025
• Location: Linux Foundation

Jeffrey Sica · Cloud Native Computing Foundation

Investigates scaling GitHub Actions To the CNCF and evaluates key implications for security practitioners.

Videos·39 min

• COMMUNITY
• Supply Chain
• Date: 2025
• Location: Community

Paul Gerste

Paul Gerste examines Zombie Workflows And Other GitHub Actions Horror Stories.

App Sec Village·26 min

• DEF CON
• Supply Chain
• Date: Aug 2024
• Location: Las Vegas

Elad Pticha · Oreen Livni

Demonstrates a command injection vulnerability in the Bazel GitHub Action that allowed malicious tampering in Google's build pipeline.

AREA41·49 min

• COMMUNITY
• Supply Chain
• Date: 2024
• Location: Community

Elliot Ward

Elliot Ward examines Action Anomalies: A Hackers Guide To Github Actions.

Main Stage·44 min

• DEF CON
• Supply Chain
• Date: Aug 2024
• Location: Las Vegas

Adnan Khan · John Stawinski

Exploiting insecure defaults in self-hosted GitHub Actions runners to compromise repositories, cloud environments, and internal networks.

RomHack·53 min

• ROMHACK
• Blue Team
• Date: 2024
• Location: Romhack

Adnan Khan

Details adnan Khan - The dark side of GitHub Actions and evaluates key implications for security practitioners.

fwd:cloudsec·21 min

• FWD CLOUDSEC
• Cloud
• Date: 2023
• Location: Fwd Cloudsec

Rojan Rijal

Rojan Rijal analyzes Vulnerabilities and Misconfigurations in GitHub Actions.

Main Stage·40 min

• DEF CON
• Supply Chain
• Date: Aug 2023
• Location: Las Vegas

Asi Greenholts

Asi Greenholts demonstrates a proof-of-concept worm propagating through the GitHub Actions ecosystem by compromising interdependent custom actions.

OWASP Global AppSec Dublin·55 min

• OWASP
• AppSec
• Date: 2023
• Location: Owasp

Magno Logan

Provides global AppSec Dublin: GitHub Actions: Vulnerabilities, Attacks, And Counter-Measures and evaluates key implications for security practitioners.

RSA Conference (RSAC)·35 min

• RSAC
• Policy
• Date: 2023
• Location: Rsa

Presenter: Stephen Giguere

Provides pwning the CI (GitHub Actions Edition) and evaluates key implications for security practitioners.

BSides Portland·43 min

• BSides
• Red Team
• Date: 2022
• Location: Bsides

Analysts investigate attack surfaces and defenses concerning Breaking Build: Red Teaming CI/CD Pipelines and GitHub Actions [BSidesPDX 2024].

BSides Tallinn·48 min

• BSides
• Supply Chain
• Date: 2022
• Location: Bsides

Elliot Ward

Presenters detail vulnerability discovery and exploitation in 2024 - Elliot Ward (Action Anomalies: A hackers guide to Github Actions).

StackHawk·1 hr 11 min

• COMMUNITY
• Community
• Date: 2022
• Location: Community

GitHub Actions

and FOSSA Webinar: Automating AppSec Testing with GitHub Actions.

StackHawk·1 hr 44 min

• COMMUNITY
• AppSec
• Date: 2022
• Location: Community

Automate WebApp Security Testing using GitHub Actions || TestJS Summit 2022.

StackHawk·1 hr 47 min

• COMMUNITY
• Community
• Date: 2022
• Location: Community

JS Security Testing in GitHub Actions Workshop | Vue.js 2021.

Strange Loop Conference·9 min

• STRANGE LOOP
• Supply Chain
• Date: 2022
• Location: Strange Loop

Marieli Wessel

Presenters detail vulnerability discovery and exploitation in Marieli Wessel: How people really use GitHub Actions.