4 ms·

SOC2 ?

• tkellogg 3y ago
  are you pushing PHI/PII through github actions?
  • CSDude 3y ago
    Does not matter - pipeline needs to be trusted because it has access to sensitive resources for deployment tasks, can fake test results etc.
    • slekker 3y ago
      Even though it is a bit of a PITA to maintain self hosted runners, it is the reason we do it.
      • Klasiaster 3y ago
        GARM can easily manage ephemeral runners for you: https://github.com/cloudbase/garm https://github.com/cloudbase/garm (Ephemeral runners are also more secure)
  • manquer 3y ago
    Actions have access to environment secrets . Those secrets can open door to PII.