Skip to content
TopicTracker
From HackerNewsView original ↗
TranslationTranslation

GitHub commit Verification logic flaw and bypass

GitHub's commit "Verified" badge checks only the committer's key, not the author field, which can be spoofed via Git env vars. Attackers can show a verified badge next to any forged identity. The defense (Vigilant Mode) is opt-in and off by default.

Related stories

  • How my minimal, memory-safe Go rsync steers clear of vulnerabilities

    6.5

    The author assesses 12 rsync vulnerabilities against his Go-based gokrazy/rsync. While both he and upstream missed some validation, Go's bounds-checking prevents memory corruption, and the minimal codebase avoids many attack surfaces. He concludes memory-safe languages and minimal implementations significantly reduce security risks.