Evan Ippolito | ZeroCreds

Security judgment for B2B SaaS teams. 6 years at Nike, ZeroFox, IDX — I know which controls actually matter for your stack. Delivered as code you keep.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Things I've found at companies that passed SOC 2:

• Containers running as root
• Action: *, Resource: * IAM policies
• GitHub Actions pinned to @main
• 387-day-old AWS access keys
• No network policies

The audit checked the box.

The infrastructure didn't care.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Nobody knew this was running.

pgAdmin on an EC2 box. Multiple major versions behind. CVSS 9.9. Remote code execution. Auth bypass. Public PoC exploits. Active exploitation in the wild.

Sitting there unpatched, unmonitored, invisible to every security review until a scanner caught it.

The scary stuff isn't zero-days. It's the forgotten admin tool that's been silently exposed for months because nobody inventoried what's actually running on their infrastructure.

Every company has some version of this. You just don't know about yours yet.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Most GitHub Actions workflows I audit use `actions/checkout@v4`.

That resolves to whatever `v4` points to TODAY. The maintainer can move that tag tomorrow.

Pin to the full SHA. It's the only immutable reference.

[Evan Ippolito | ZeroCreds @evan_cloudops]

OAuth tokens with no expiration and overly broad scopes are just long-lived credentials wearing a trenchcoat.

If you're not auditing which third-party apps have consent grants in your IdP, you have shadow access you don't know about. Revoke what you don't recognize.

[Evan Ippolito | ZeroCreds @evan_cloudops]

This is a defaults problem, not a knowledge problem.

Teams ship fast, security configs stay at whatever the framework gave them.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Things I've found at companies that passed SOC 2:

• Containers running as root
• Action: *, Resource: * IAM policies
• GitHub Actions pinned to @main
• 387-day-old AWS access keys
• No network policies

The audit checked the box.

The infrastructure didn't care.

[Evan Ippolito | ZeroCreds @evan_cloudops]

1,200+ malicious npm packages this month alone. Typosquatting is the new phishing — except it hits your build server, not your inbox. Run `npm audit` in CI and actually BLOCK on critical findings instead of logging and ignoring.

[Evan Ippolito | ZeroCreds @evan_cloudops]

The Ollama supply chain attack is a perfect example of why you never pull unsigned container images — even from repos you trust.

Attackers pushed a poisoned Docker image that exfiltrated AWS creds and .env files 4.5K+ times before anyone noticed.

Sign your images. Verify digests. Isolate runtime credentials.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Happy Place

[Evan Ippolito | ZeroCreds @evan_cloudops]

Most teams grant their CI runner admin-level repo tokens by default. `permissions: contents: read` at the workflow level cuts that blast radius dramatically. Your build step doesn't need write access to your repo.

[Evan Ippolito | ZeroCreds @evan_cloudops]

@ppetryszen Right? The essentials!

[Evan Ippolito | ZeroCreds @evan_cloudops]

Your IAM policy probably has `Resource: "*"` on at least one statement. That wildcard is doing more work than your entire security team. Scope it to specific ARNs — even partial wildcards like `arn:aws:s3:::logs-*` are a massive improvement.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Most GitHub Actions workflows I audit use `actions/checkout@v4` instead of pinning to a SHA.

That means a compromised tag update hits your pipeline automatically. No PR, no review, no alert.

Pin to the commit SHA. It takes 30 seconds and removes an entire attack vector.

[Evan Ippolito | ZeroCreds @evan_cloudops]

What's included:
- AWS posture (Prowler)
- GitHub org + CI/CD security
- Container scanning (Trivy)
- App security (Semgrep)
- External exposure assessment

You get a prioritized findings report + mergeable remediation artifacts.

20-200 engineers, AWS, GitHub? DM me.

https://t.co/7FjFhuBL5H

[Evan Ippolito | ZeroCreds @evan_cloudops]

I've been building ZeroCreds — security consulting that ships working remediation code instead of slide decks.

Offering 3 free security baseline audits for B2B SaaS startups. I'm building case studies and being transparent about it.

Details below.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Most teams set up IAM roles for their EKS pods and never revisit them. Six months later half those roles have permissions for services the app doesn't even call anymore. Audit your IRSA bindings quarterly or accept the blast radius.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Your first SOC 2 audit doesn't need a full-time security hire. It needs someone who's scoped one before. A fractional CISO for 3 months costs less than a bad first hire and gets you through Type I without building a team you can't sustain yet.

[Evan Ippolito | ZeroCreds @evan_cloudops]

@PLBompard Ship code, not CVEs.
https://t.co/9Wllso4WHA

[Evan Ippolito | ZeroCreds @evan_cloudops]

Signed up 💪

[Claude @claudeai]

We're launching Claude Community Ambassadors. Lead local meetups, bring builders together, and partner with our team.

Open to any background, anywhere in the world.

Apply: https://t.co/DTQBAzgQug

[Evan Ippolito | ZeroCreds @evan_cloudops]

If your GitHub Actions workflow uses `aws-actions/configure-aws-credentials` but you're still passing in a secret key, you're doing OIDC wrong. The `role-to-assume` param with `role-session-name` and NO access key inputs is the actual zero-credential setup.

[Evan Ippolito | ZeroCreds @evan_cloudops]

Also — commit your lockfiles. If you're not committing them, dependency review can't diff what changed. It's the whole mechanism.

Full config walkthrough with production-ready examples here: https://t.co/cUk9ik67hp

[Evan Ippolito | ZeroCreds @evan_cloudops]

One npm package added in a PR. 47 transitive dependencies pulled in. Three critical vulns. One license that quietly switched from MIT to AGPL.

Nobody caught it. Merged and shipped to production.

[Evan Ippolito | ZeroCreds @evan_cloudops]

The move most teams miss: pair dependency review WITH Dependabot.

Dependency review catches bad deps coming in. Dependabot catches bad deps already there. Together they cover both directions.