RC RANDOM CHAOS

security posture

2 posts

HuggingFace serves a disclosure channel, not a control
Article

HuggingFace serves a disclosure channel, not a control

HuggingFace's security.txt defines a disclosure channel, not a security control. Publishing it expanded the commitment surface, not the platform's defenses.

 A Trivy-based CI/CD misconfiguration led to credential exposure in a Cisco-related incident
Article

A Trivy-based CI/CD misconfiguration led to credential exposure in a Cisco-related incident

A review of how a misconfigured Trivy scan in Cisco's CI/CD pipeline led to AWS credential exposure due to unverified post-scan execution. Explores the systemic failure behind treating scanning outputs as trusted signals.