Key Takeaways - Tags aren't permanent. Git tags can be rewritten without warning. Pipelines referencing v0.69.4 instead of commit SHAs trust that version hasn't moved. It had. - Secrets in untrusted code. pull_request_target workflows execute external contributor code with full access to CI/CD secrets. One misconfigured workflow was the entry point for all five ecosystems. - Credentials as lateral...