Skip to content
T threat.cafe

Tag

#harden-runner

1 post

  1. · Nadia Ferreira-Strand · Enforcement architecture · on threat.cafe

    Egress allowlisting for coding agents and CI runners: the control that would have stopped the axios callback

    Most agent-ecosystem malware has to phone home. An outbound allowlist on CI runners and agent sandboxes contains compromises that known-bad lists miss. Start in audit mode, then block. The ongoing cost is keeping the list current.