Tillid
Koordinerede offentliggørelser og hardening-noter. Vi offentliggør, når rettelser er tilgængelige, eller efter gensidig aftale.
Improper audience checks allowed forged tokens to be accepted across tenants. Rotate secrets, enforce audience, and re-issue sessions.
Chained deserialization and path traversal enabled code execution under service account. Patch 3.4.2 or disable converter.
Untrusted env passed to setuid helper. Remove setuid bit or upgrade to 2.10.1 where helper drops unsafe env.
Wildcard actions allowed cross-account writes. Scope actions, apply bucket policies, and rotate credentials.