Miles

just a dev building small tools on the internet. AI × dev tools × shipping in public. made Pin Check, a free GitHub Actions pin checker.

[Miles @MilesBuilds]

Solo dev shipping small tools. The first is Pin Check, a free checker for GitHub Actions that aren't pinned to a commit.

Every day I post one AI or dev story with the source linked. What each app earns goes here too.

[Miles @MilesBuilds]

@wiz_io did environments with a branch rule or required reviewers stop it? a ci-sync- branch shouldn't pass a main-only rule, so i'd expect those prod secrets to stay out of the matrix jobs

[Miles @MilesBuilds]

@devops_nk you can add gheist from this morning. wiz found 13500 ci-sync- branches pushed with stolen github tokens. the workflow on each one prints the repo's secrets to the actions log in base32, then deletes the run

[Miles @MilesBuilds]

@julianor so leaving br out of accept-encoding doesn't save you if the server sends it anyway. were any of the clients that crashed node or bun?

[Miles @MilesBuilds]

Wiz has been tracking a campaign called Gheist since Sept 15. Attackers use stolen GitHub tokens to push a branch named ci-sync- plus 6 random characters. Its workflow prints the repo's secrets into the Actions log in base32, so masking never sees the real string. Then it pulls the log and deletes the run.

Wiz has found 13500 of these branches from more than 850 accounts. Public repos got held for approval. Private repos and GitHub Enterprise Server ran it.

Deleting the branch undoes nothing. If you find a ci-sync- branch, rotate every secret that repo had.

[Miles @MilesBuilds]

@marclou Please don't say that. I don't want to be below average hahaha.

I'm glad to find you and also Levelsio. Inspiring to grow succeed.

[Miles @MilesBuilds]

@lunaonexbt i'd care less about the hosting and more about the defaults. a 2025 scan of lovable's showcase found about 170 of 1645 apps with supabase tables open to anyone with the public anon key

[Miles @MilesBuilds]

@mattpocockuk curious if the factory section covers the token. an agent that opens PRs from issue text gets a write token, and anyone can write an issue body

[Miles @MilesBuilds]

@hmier the vendored copies are the slow part. apt upgrade fixes the system libbrotli, but node, bun and the python wheels each ship their own decoder and need their own release

[Miles @MilesBuilds]

github blocks pull_request_target in public repos by default from nov 2. until then the rule runs in evaluate mode and only records what it would have stopped. 76 of the 200 most-starred repos use that trigger. check what it flagged in your repos before the blocking starts.

[Miles @MilesBuilds]

5 dev-security stories from this week, and what to do about each:
- railway env var breach
- litellm 1.107.0 on pypi
- node2shell in brotli
- php2shell
- github turning off pull_request_target on nov 2
one post each 🧵

[Miles @MilesBuilds]

php2shell lives in the php runtime. updating wordpress or laravel won't fix it. the fixed runtimes are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. distro packages often patch without changing the version, so check the changelog for the CVE ids.

[Miles @MilesBuilds]

@theomlondhe nice catch on the anchored regex letting GH_TOKEN and NPM_TOKEN slip past. did you run job_workflow_ref through the same matcher? i'd want to know if it still holds when the attacker controls the calling workflow

[Miles @MilesBuilds]

@hii_mohit ok, you have my attention. finder has been the slowest part of my mac for years. does it search inside files too, or only names?

[Miles @MilesBuilds]

@marclou glad you got your family on it too. did the agents also check the api keys in your github secrets and hosting env vars? new passwords don't touch those, and that's the kind of key that leaked at railway and opencode this month

[Miles @MilesBuilds]

@ahamam101 Same salary ?
And same amount of time to deliver ?

If so I will trust the developer doing it manually. If the 90% can do it faster and understand his code (I guess since is the same quality) then the ai dev.

[Miles @MilesBuilds]

i put a permissions block with contents: read into every new repo's workflows before anything else.

what's the first thing you add?