centuryfall

While it is definitely an issue if a single agent has access to both public and private data, this feature shouldn’t have been delivered where this is an allowed state. At least, GitHub should have ensured there are two kinds of agents: one for public, and one for internal, and prevent crossover between them. I get this doesn’t appear to be the most shiny feature, but the other, current side is just allowing Pandora’s box to be opened by naive policies.

Lastly, even with a private agent, being able to ask it for secrets and have it likely respond with them back is really, really, really bad.

Why is that an issue though when it is the lesser of two evils? At the very minimum, regardless of “misconfiguration” or not, not having any type of warnings to advise against this behavior is quite bad.

Misconfiguration isn’t really the best word choice, either, because it’s definitely a both-sides problem.