---
title: "crimsondhaks (@helgafinn) | Hashnode"
description: "crimsondhaks (@helgafinn) writes on Hashnode. Read their latest articles and follow their work."
url: "https://hashnode.com/@helgafinn"
---

@helgafinn

# crimsondhaks

@helgafinn · Bangalore, India · Joined September 2026

### [The dead assets you can no longer grep for](https://helgafinn.hashnode.dev/the-dead-assets-you-can-no-longer-grep-for?utm_source=hashnode&utm_medium=feed)

Every app accumulates resources nothing uses. An image outlives the screen that displayed it. A colour survives the design system that named it. A localization key outlasts the copy it translated. Non

6 min read · [helgafinn.hashnode.dev](https://helgafinn.hashnode.dev/the-dead-assets-you-can-no-longer-grep-for?utm_source=hashnode&utm_medium=feed)

[Sep 3](https://hashnode.com/posts/the-dead-assets-you-can-no-longer-grep-for/6a991711c0f72eb9026a1704)

### [Pinning GitHub Actions to a SHA is not protection](https://helgafinn.hashnode.dev/the-pin-you-stopped-reading?utm_source=hashnode&utm_medium=feed)

In March 2025 an attacker compromised tj-actions/changed-files and rewrote its release tags to point at malicious code. The injected code dumped runner memory into workflow logs, which on a public rep

6 min read · [helgafinn.hashnode.dev](https://helgafinn.hashnode.dev/the-pin-you-stopped-reading?utm_source=hashnode&utm_medium=feed)

[Sep 2](https://hashnode.com/posts/the-pin-you-stopped-reading/6a98170a6e09d1fb59c17fbc)