Codecov breach showed how a single script can leak every CI secret
In Jan 2021 attackers slipped a line into Codecov’s bash uploader, causing every CI run to exfiltrate environment variables to an attacker‑controlled server for 61 days. The incident proves that the CI pipeline is the new perimeter, and that any integrated tool can become a silent data‑leak vector.