Does zizmor catch this pull_request_target vs cache poison vulnerability? | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		joshuanapoli 15 days ago \| parent \| context \| favorite \| on: Postmortem: TanStack NPM supply-chain compromise Does zizmor catch this pull_request_target vs cache poison vulnerability?

woodruffw 15 days ago [–]

Yes, it catches both.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact