Skip to content

Commit 211fee2

Browse files
Update endpoint (step-security#155)
1 parent 510a6fa commit 211fee2

2 files changed

Lines changed: 5 additions & 5 deletions

File tree

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ Lets kick things off with a challenge designed to get your analytical gears turn
1919

2020
- Take a look at the [publish.yml](.github/workflows/publish.yml) GitHub Actions workflow.
2121
- This workflow uses the [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner), which provides Security Observability and Runtime Enforcement for GitHub Actions workflows.
22-
- Now, we present you with the puzzle. Check out these [network events monitored during a workflow run](https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/6285441645) of this workflow. Notice anything odd?
22+
- Now, we present you with the puzzle. Check out these [network events monitored during a workflow run](https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/6292618211) of this workflow. Notice anything odd?
2323

2424
**Why is there an outbound call to `attacker.com` during the workflow run?** Is this expected, or something more nefarious?
2525

docs/Solutions/RestrictOutboundTraffic.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,10 @@ For a demo of a workflow running on ARC with Harden Runner integrated, follow th
8181
Notice that `harden-runner` Action is not added to this workflow, and that this workflow runs on a `self-hosted` runner.
8282

8383
2. Check out an example run of this workflow here:
84-
https://github.com/step-security/github-actions-goat/actions/runs/6285442172
84+
https://github.com/step-security/github-actions-goat/actions/runs/6292615173
8585

8686
3. Visit the workflow insights for this run here:
87-
https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/6285442172
87+
https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/6292615173
8888
You can see the outbound traffic for each of the steps, without the need to add `harden-runner` to each job.
8989

9090
Even though you do not need to add Harden-Runner Action, the insights are exactly the same as with GitHub-Hosted runner.
@@ -122,9 +122,9 @@ While there is a secure-by-default policy, to filter traffic to specific destina
122122
Notice that `harden-runner` Action is added and there is a list of allowed endpoints.
123123

124124
2. Check out an example run of this workflow here:
125-
https://github.com/step-security/github-actions-goat/actions/runs/6285439406
125+
https://github.com/step-security/github-actions-goat/actions/runs/6292614301
126126

127127
3. Visit the workflow insights for this run here:
128-
https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/6285439406
128+
https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/6292614301
129129

130130
You will notice that the call to `attacker.com` was blocked in this case.

0 commit comments

Comments
 (0)