Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

Noma Security researchers discovered that public GitHub issues can trick GitHub Agentic Workflows into leaking private repository data. This vulnerability occurs when organizations grant agents read access across repositories, allowing attackers without credentials to extract private content. Separately, a new tool enables users to scan any public GitHub repository for security issues in seconds without an account. This service utilizes static analysis, secret detection, and dependency scanning to provide a security grade for source code.