Your GitHub profile shows your follower count. It also shows attackers your whole attack surface.

The weekend project everyone's shipping — a GitHub Action that auto-updates a badge on your profile README — quietly hands attackers a map of your tokens, your workflow permissions, and your supply chain. Here's exactly what a profile-automation workflow exposes, and the five-line fix that keeps the badge and closes the door.

Read the full article at dev.to →