Products Relying on Personal Git Repos

You know how some security conscious people call out &ldquo;curl pipe to sh&rdquo;? Referencing random repos, without pinned hashes for reference is the same. An example of the &ldquo;curl pipe to sh&rdquo;: curl -fsSL https://deno.la I just came across another example today in the USB/IP docs for Docker. If it was pinned to a specific hash, assuming it had been reviewed there at least…