BoostSecurity Blog

Software development has changed. You need a Boost. Boost Security brings together enterprise-grade unified AppSec, supply chain security for all your code, and developer endpoint protection.

Popular posts: 1
Total points: 111
HN comments: 58
Rank: #9,295 company

Visit boostsecurity.io → On Hacker News Jun 2025 – Jun 2025

Security & Privacy 1 Software Engineering 1

Most points Most discussed Most cited Newest

Weaponizing Dependabot: Pwn Request at its finest

2025111 points58 comments Security & Privacy details

Your trusty Dependabot (and other GitHub bots) might be an unwitting accomplice. Through "Confused Deputy" attacks, they can be tricked into merging malicious code. This doesn't stop here. It can escalate to full command injection via crafted branch names and even bypass branch protection rules. Plus, we disclose two…