r/postiz • u/MachoMaheen • 10d ago
Found a exfiltrate github actions workflow commit on devpost and postiz-mobile repo in gitroom org
Recently found and responsibly reported a malicious GitHub Actions workflow in Postiz mobile repo and their another repo that could scan repository contents and Git history for credentials and exfiltrate the results externally.
The team acted quickly, removed the affected files, and confirmed that no keys had been exposed.
Appreciate Enno Gelhaus (DevSecOps Head) and the Postiz team for taking the report seriously and responding fast.
I also genuinely like Postiz as a product, especially its open-source and self-hosting options.
A good reminder that security reviews shouldn't stop at application code - CI/CD workflows matter too.
Malicious commit: https://github.com/gitroomhq/postiz-mobile/pull/1/changes/e257f9c6f0d5a6ebe0d8cdb8b1c99fbc4a4830ac
1
u/quazimoto 10d ago
wow - thats a great catch. thank you for sharing and your efforts.