We found vulnerabilities in GitHub Actions Pipelines

Shared by kevin_nisbet under https://news.ycombinator.com/item?id=31194139, and I found it be more generally applicable