How a GitHub Triage Role Hijacked an Already-Authorized Claude Code Action Run
HackerOne #3918594 · Claude Code Action v1.0.185, commit 9db594c7a0e82298c121c18b7f08aa1579ce7341 · CVSS 4.0 score 7.5, High
Authorizing an automated job is really two promises: who gets to start it,
security-research.hashnode.dev10 min read