One workflow misconfiguration can hand an attacker your repository.
This is a dev post classified by AGK Intelligence as Security (a tool drop), kept by the Dev Radar because it carries real work, not commentary.
One workflow misconfiguration can hand an attacker your repository. Barak Haryati, Senior Director of Product Security at JFrog, built RepoHunter in 48 hours. It’s an AI-driven research bot that pairs static analysis with #LLM reasoning to find exploitable #CICD workflows at scale. This led to responsibly disclosing 30+ critical vulnerabilities across major open-source and enterprise projects. At @owasp Global AppSec USA, he shows how these attacks work and how you can combine static analysis with AI reasoning to catch the next CI/CD supply chain attack before it ships. If you own a pipel
Posted by JFrog (23.3k followers) 2 days ago · 2 likes · 203 views · view the original post on X. Kept by the Dev Radar as Security.
More dev work like this
- CVE-2024-21413: MonikerLink Outlook Vulnerability PoC — @DarkWebInformer
- CrowdStrike President Michael Sentonas joined Sascha Roehrer on deeptech INSIGHTS to… — @CrowdStrike
- I just shared this with my family, and you all should do it too. — @JJEnglert
- Securing AI shouldn't add complexity. — @PaloAltoNtwks
- Standing room only at the Boston Kubernetes Meetup last night for Teleport’s Paul Curtis… — @goteleport
- AI adoption is accelerating. Stopping emerging AI threats takes elite expertise. — @CrowdStrike
- Names, emails, API keys—Our ambassador @povedaai is putting MiniCPM4-0.5B to work… — @OpenBMB
- Finding vulnerabilities is one thing. Preventing them from being merged is another. 🔐 — @gitlab
Every post is read and classified by AGK Intelligence: what it is, which market it belongs to, and whether the link is a real tool. 31.2k posts from 5k X accounts over the last 21 days, 8.8k tools, 12 markets. New posts are collected several times an hour and the full ranking is recomputed every hour — last update 2026-10-30 20:27 UTC. Full method.