Angular automation trust and cache isolation weakness
A Google-rewarded report connected an adjacent CI misconfiguration with insufficient separation of automation trust, creating a potential Angular supply-chain impact.
USD 31,337reported awardRead
SCSecurity theme
Software supply-chain security.
Build systems, package provenance, release integrity, and automation trust. 6 disclosures · 4 related references · 2 diagrams.
Connected collection
Disclosures
GitHub package-source trust allowed dependency confusion
A researcher reported one dependency-confusion finding affecting GitHub build and development services and a $20,000 award.
USD 20,000reported awardRead
Cloud Build approval was not bound to immutable code
A researcher-reported USD 30,000 award illustrates a gap between approval of a contribution and selection of the code executed.
USD 30,000reported awardRead
GitHub runner-image builds shared persistent infrastructure with untrusted workflows
An isolation misconfiguration exposed runner-image build infrastructure; the researcher reports a $20,000 payment.
USD 20,000reported awardRead
GitHub Actions trust depended on invalid repository references
A reference-validation flaw crossed the GitHub Actions trust boundary and earned USD 25,000.
USD 25,000reported awardRead
Meta Conversions API Gateway mixed configuration data with executable output
The researcher attributes a USD 250,000 award to the article’s separately identified backend finding, Bug #2.
USD 250,000reported awardRead
Connected collection
Related learning
NIST SP 800-190: Application Container Security Guide
A foundational model of container images, registries, orchestration, runtimes and host security. It explains shared-kernel risk, workload separation, constrained runtime permissions and lifecycle maintenance.
Reviewed 2026-10-02Read
Authorization Cheat Sheet
Practical design guidance covering least privilege, deny-by-default behavior, consistent per-request decisions, failure handling, logging, and authorization regression tests.
Reviewed 2026-10-02Read
OWASP Transaction Authorization
Explains operation-specific approval: show significant transaction details, preserve authorized data, enforce valid state transitions and recheck authorization at execution.
Reviewed 2026-10-02Read
SLSA v1.2: supply-chain security and build provenance
Learn to assess software supply-chain assurance using distinct source and build tracks. The build track progresses from recording provenance to authenticated hosted builds and stronger platform isolation. Build…
Reviewed 2026-10-02Read
Connected collection
Visual models
Approval stays attached to the reviewed version
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Build evidence must match the artifact and trusted builder
Editorial conceptual model combining the Angular case with SLSA build guidance. The case supports separating automation trust and shared build state; the consumer verification gate is a general design synthesis, not a…
Reviewed 2026-10-03Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
d5550c789111 · JSON exports & schemas · CC BY 4.0 content / MIT software