Ep 60 - Build Pipeline Exploitation, Supply Chain Attacks, and SmokedMeat for ProdSec

🎙️ Coffee, Chaos and ProdSec, Ep 60

Your build pipeline runs whatever gets pushed to it. Your secrets sit unmasked in runner memory. And the attackers figured this out before your defenders did.

This week Cameron and Kurt bring on François Proulx, CTO of Boost Security, who spent four years publishing supply chain research only to watch threat actors quote his own tools back to him on a dark web forum. So he built SmokedMeat, Metasploit but for CI/CD, and a CTF called whooli so you can run it without going to jail.

From the Ultralytics and tj-actions compromises, to dumping OIDC tokens straight out of an ephemeral runner, to why private repos are the bigger risk and not the safer one, this episode gets into how build pipeline exploitation actually works and what Product Security teams keep getting wrong. Real attack paths, real incidents, and the AI angle making all of it faster.

If you work in ProdSec, DevSecOps, Security Architecture, or Cybersecurity and you still don't threat model your YAML, this one is for you.

☕ New episodes every Wednesday.

Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.