A Short-Lived Token Can Still Have a Large Blast Radius

Thu, 01 Jan 2026 00:00:00 +0000

The release job has no stored cloud key. It asks GitHub for an identity token, exchanges that token for a five-minute production credential, deploys, and lets the credential expire.

A compromised dependency runs in the same job. It can use the same identity request interface and deploy while the credential is live. Five minutes sounds short on a policy diagram. For hostile code already executing inside the job, it is plenty.

Credentials on Brian Faust

A Short-Lived Token Can Still Have a Large Blast Radius