Trustfix @Trustfixdev

NHI Security Platform. Detect OIDC trust policy misconfigs in AWS IAM, auto-fix via Terraform PR. 10,000 repos scanned. Built by a 12yr SRE. Free @ https://t.co/PCg8p2RsH8 trustfix.dev Joined April 2026

Tweets

7
Followers

0
Following

27
Likes

5

Trustfix @Trustfixdev

3 months ago

how role ARNs get exposed in public GitHub repos: 80.1% not visible 9.5% via GitHub Secrets 7.6% hardcoded in YAML 2.8% environment variables that 7.6% = 4,163 workflows with account ID and role name in plain text in a public repo.

0 0 0 3 0

View Details

Trustfix @Trustfixdev

3 months ago

StringEquals vs StringLike in IAM trust policies: StringEquals treats * as literal. StringLike treats * as wildcard. StringEquals with "repo:*" matches nothing. StringLike with "repo:*" matches everything. the operator matters more than the value.

0 0 0 5 0

View Details

Trustfix @Trustfixdev

3 months ago

the EC breach: 1. compromised Trivy 2. stole static AWS API key from CI pipeline 3. enumerated IAM, ECS, Lambda, Secrets Manager 4. exfiltrated 92GB across 30+ EU entities 5. undetected for 5 days every step after 2 was preventable with scoped OIDC trust policies.

0 0 0 12 0

View Details

Trustfix @Trustfixdev

3 months ago

AWS added repository_id as an OIDC condition key in Jan 2026. the old "repository" key follows the repo name. rename it, the trust follows. repository_id is immutable. follows the repo, not the name. 3 months later, almost nobody is using it.

0 0 0 6 0

View Details

Trustfix @Trustfixdev

3 months ago

@0xdabbad00 the sts: IdentityTokenAudience values are interesting - feels like we're going to see a lot of trust policies written for these new service namespaces with overly broad wildcards because nobody knows the exact values yet. same pattern when github actions OIDC first launched.

0 0 2 71 0

View Details

Trustfix @Trustfixdev

3 months ago

most teams that set up OIDC for GitHub Actions → AWS use StringLike on the sub claim. StringLike: repo:acme-corp/* means every repo in your org can assume that IAM role. one character is the difference between "secure" and "looks secure."

0 0 0 12 0

View Details

Trustfix @Trustfixdev

3 months ago

Non-human identities outnumber humans 100:1 in cloud. We scanned 10,000 GitHub repos: - 80.7% still use static AWS credentials - 743 vulnerable to fork-based attacks This is what the Trivy/Cisco breach exploited. trustfix.dev