GitHub Actions workflow lockfiles entered public preview on October 14, 2026, moving dependency pins into a lockfile and extending them to previously “unpinnable” actions: dependencies nested inside composite actions that you couldn’t pin from your own workflow. We adopted them in poutine’s CI/CD and tested both nested dependency pinning and fork pull request behavior. Locked dependencies stayed fixed when upstream branches moved, and Require lockfile blocked workflows without lockfile coverage. We also found and reported a validation defect that allowed a fork-only commit to pass as an upstream action. GitHub deployed a backend fix within hours, and our retest confirmed that the bypass was closed while a legitimate locked workflow continued to run. A CLI verification fix is still pending.
François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.
We shipped detection rules in Boost Security Developer Endpoint Protection and Dazio. Now meet emBarrass: our open-source tool for showing whether your everyday developer tools still trust a weak CA key.
In late April 2026, GitHub shipped a changelog post introducing immutable subject claims for GitHub Actions OIDC tokens, then pulled the post six hours later. The feature stayed live in production into the next day. During that short window, I (and, as I'd learn later, at least one other person) realized the new `<org>-<org_id>` format opens a pre-hijack opportunity: anyone can register a legacy organization whose name is a perfect string collision for a future victim's immutable subject claim, then wait for the victim to opt in. I disclosed via HackerOne the next morning; the feature was disabled in production about an hour later. GitHub later reshipped it with `@` (not a hyphen) as the delimiter, which closes the collision; the namespace-recycling problem it addresses was first disclosed by Tal Skverer in February 2025.
François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.
More than 30 @redhat-cloud-services npm packages shipped a credential-stealing worm. How they were published is now well-documented across several independent reports. We focus on the uncomfortable part: every supply-chain trust control passed. The packages carried valid SLSA provenance, npm trusted publishing accepted them, and branch protection on main was never touched. They passed because trusted publishing anchors trust to a workflow filename on any branch, not to a protected release identity, and the provenance that vouched for the packages faithfully recorded the throwaway branch that nobody checked.
François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.
In March 2026, TeamPCP unleashed mayhem on the software supply chain: compromising Trivy, LiteLLM, KICS, Telnyx, and dozens of npm packages, proving that CI/CD pipelines are the softest target. Today we're open-sourcing SmokedMeat, the first red team framework for build pipelines (i.e. CI/CD), so defenders can finally see the full kill chain for themselves.
François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.
A fake billion-dollar unicorn, fully booby-trapped. Point SmokedMeat at it and walk the full kill chain from a drive-by GitHub Issue comment to cloud admin, safely.
