Racing for Hidden Treasures in Public GitHub Repositories - Exploiting Build Artifacts

This talk explains how attackers can find exposed tokens in public GitHub Actions build artifacts and use them before they expire. It also describes poisoning project artifacts and caches, with examples involving open-source projects.