• 6 min read
• API Stronghold Team
The Trivy Attack Didn't Need a Zero-Day. It Needed Your Env Vars.
Attackers hijacked 75 Trivy GitHub Action tags without finding a single vulnerability in your code. They targeted the secrets you left in CI env vars — and thousands of pipelines handed them over.
ci-cd github-actions supply-chain secrets-management api-security