PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bringing full YAML anchor support to zizmor

blog.trailofbits.com | blog | #supply-chain | #devsecops | #open-source | #github-actions | #static-analysis | #zizmor | #yaml | #ci-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits worked with zizmor maintainers to fix four YAML anchor handling bugs and align its evaluator with GitHub's tests, validating against 41,253 real-world GitHub Actions workflows.
Published
Collected

Related coverage

blog · about.gitlab.com
Building AI security in the open
GitLab has joined the Open Secure AI Alliance to help advance transparent, adaptable approaches to securing AI systems.
tool · github.com
Droid ASC: High-Performance On-Demand Android Decompiler Front-End for Mobile Security & AI Agents
Radically reduces Android reverse-engineering overhead from tens of minutes and gigabytes of memory to milliseconds and megabytes, providing an ideal, stateless code analysis primitive for autonomous security agents and vulnerability researchers.
blog · blog.trailofbits.com
Package managers have an integrity problem
# Package managers have an integrity problem Keegan Ryan October 14, 2026 supply-chain, cryptography, ecosystem-security Page content * Simulating malicious package repositories * HTTPS is...
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
Back