Update README.md

step-security · Jan 20, 2025 · 529f54d · 529f54d
1 parent 4791440
commit 529f54d
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -1,3 +1,4 @@
+test checks
 # GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment
 
 [![Maintained by stepsecurity.io](https://img.shields.io/badge/maintained%20by-stepsecurity.io-blueviolet)](https://stepsecurity.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=harden-runner)
@@ -83,4 +84,4 @@ GitHub Actions Goat not only demonstrates vulnerabilities but also presents solu
 | 2.  | Lack of CI/CD Runtime Security can lead to Tampering of Source Code or Artifacts during Build            | [GitHub Actions Runtime Security - Detect File Tampering](docs/Solutions/MonitorSourceCode.md)                                                                                                                                                                                                  | ["Implement endpoint detection and response (EDR) tools" in CISA/NSA guide](https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF)                                                                                                                                                                                                                                                                                                                                                                                                  |
 | 3.  | Lack of Detailed Audit Logs for CI/CD Activities                                                         | [Forensically Reconstruct An Incident Post-Compromise](docs/Solutions/ForensicAnalysis.md)                                                                                                                                                                                                                  | ["Keep audit logs" section in CISA/NSA guide](https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF)                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | 4.  | Use of Long-Term CI/CD Credentials                                                                       | [Audit and rotate registered secrets](docs/Solutions/AuditGitHubActionsSecrets.md) | 1. ["Audit and rotate secrets" in GitHub's Security Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-secrets) <br/>2. ["Using OpenID Connect to access cloud resources" in GitHub's Security Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-openid-connect-to-access-cloud-resources) <br/>3. ["Minimize the use of long-term credentials" in CISA/NSA document](https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF) |
-| 5.  | Use of Untrusted 3rd Party GitHub Actions                                                                |  [Review GitHub Actions used across your Organization](docs/Solutions/ReviewGitHubActions.md)                                                                                                  | 1. ["Using 3rd party Actions" in GitHub's Security Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) <br/>2. ["Restrict untrusted libraries and tools" section in CISA/NSA document](https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF)                                                                                                                                                                                                                |
+| 5.  | Use of Untrusted 3rd Party GitHub Actions                                                                |  [Review GitHub Actions used across your Organization](docs/Solutions/ReviewGitHubActions.md)                                                                                                  | 1. ["Using 3rd party Actions" in GitHub's Security Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) <br/>2. ["Restrict untrusted libraries and tools" section in CISA/NSA document](https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF)                                                                                                                                                                                                                |