Octoscan warns GitHub Actions risk

- Octoscan researchers flagged expression‑injection and other risky patterns in public GitHub Actions that allow attackers to run code inside CI workflows. - The tool’s report highlighted specific expression parsing flaws and flagged dozens of popular Actions with exploitable inputs that can lead to secrets exposure. - Teams were urged to audit reusable Actions, pin action versions, and treat Actions inputs as untrusted user data. (x.com)