Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think it's obvious too. I'd call out any case of `${{ }}` interpolation in a `run` block, and it's something I watch for in PRs. I also know other people don't watch for this, as I've corrected it about a hundred times. Over the last 10 years my average colleague understands less and less about injection or to watch for it at layer boundaries.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: