Meetup

OSSIR

Living Off The Pipeline : Recherche défensive, usage offensif

Nov 10, 2026
Remote
François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

Remote presentation (in French) to OSSIR (Observatoire de la Sécurité des Systèmes d'Information et des Réseaux): French edition of "Living Off The Pipeline: Defensive Research, Weaponized", covering how threat actors weaponized our CI/CD research and SmokedMeat, the open source red team framework for CI/CD pipelines.


### 2026

PolySécure Oct 13, 2026

Teknik - Dazio ou comment protéger le poste d'un développeur

Alexis-Maurer Fortin
Alexis-Maurer Fortin
Alexis-Maurer Fortin Senior Product Security Engineer

Alexis-Maurer is a co-creator of poutine and the architect behind Boost Security's large-scale cloud scanning infrastructure. He single-handedly created bagel, the open source developer workstation security scanner, and remains its core maintainer. He is also an active contributor to Dazio. A prolific Go developer, he wrote the majority of the codebase powering the team's automated vulnerability discovery systems.

Black Hat SecTOR 2026 Arsenal 🇨🇦 Arsenal Station 3, Toronto, ON Oct 7, 2026

SmokedMeat: like Metasploit, but for CI/CD

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

FLOSS Weekly Jul 29, 2026

RCE As a Service

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

PolySécure Jul 15, 2026

Teknik - Living Off The Pipeline: Defensive Research, Weaponized

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

Enterprise Security Weekly Jul 13, 2026

Hungry? We talk Smoked Meat, Poutine, and Bagel

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

TROOPERS26 🇩🇪 Heidelberg Jun 24, 2026

Living Off The Pipeline: Defensive Research, Weaponized

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

SmokedMeat: Offensive CI/CD and Supply Chain Security

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

NorthSec 2026 🇨🇦 Montréal, QC May 14, 2026

Living Off The Pipeline: Defensive Research, Weaponized

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

PolySécure Apr 4, 2026

Teknik - Trivy... part 2 ou comment le supply chain est LE vecteur

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

PolySécure Mar 11, 2026

Teknik - Hackerbot-claw

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

, Sébastien Graveline
Sébastien Graveline
Sébastien Graveline Security Researcher

Sébastien brings Red Team expertise to the research team and is a major contributor to the Living Off The Pipeline (LOTP) project. He maintains and continuously improves Boost Security's large-scale infrastructure for hunting vulnerabilities in open source build pipelines, and handles coordinated disclosure with the company's largest customers. An avid CTF player who has won several prestigious competitions, he contributes actively to the team's most cutting-edge research.

### 2025

PolySécure Dec 4, 2025

Teknik - Don't Go with the Flaw

Garance De La Brosse
Garance De La Brosse
Garance De La Brosse ex-Junior Security Researcher

Garance completed her M. Eng thesis with the team, focusing on distribution threats to the Go ecosystem and package manager vulnerabilities.

, François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

PolySécure Nov 11, 2025

Teknik - Split-Second Side Doors: How Bot-Delegated TOCTOU Breaks The CI/CD Threat Model

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

, Alexis-Maurer Fortin
Alexis-Maurer Fortin
Alexis-Maurer Fortin Senior Product Security Engineer

Alexis-Maurer is a co-creator of poutine and the architect behind Boost Security's large-scale cloud scanning infrastructure. He single-handedly created bagel, the open source developer workstation security scanner, and remains its core maintainer. He is also an active contributor to Dazio. A prolific Go developer, he wrote the majority of the codebase powering the team's automated vulnerability discovery systems.

, Sébastien Graveline
Sébastien Graveline
Sébastien Graveline Security Researcher

Sébastien brings Red Team expertise to the research team and is a major contributor to the Living Off The Pipeline (LOTP) project. He maintains and continuously improves Boost Security's large-scale infrastructure for hunting vulnerabilities in open source build pipelines, and handles coordinated disclosure with the company's largest customers. An avid CTF player who has won several prestigious competitions, he contributes actively to the team's most cutting-edge research.

The Security Repo Oct 29, 2025

Supply Chain Warfare: CI/CD Threats and Open Source Security

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

LASCON 2025 🇺🇸 Austin, TX Oct 23, 2025

Under the Radar: How we found 0-days in the Build Pipeline of OSS Packages

Alexis-Maurer Fortin
Alexis-Maurer Fortin
Alexis-Maurer Fortin Senior Product Security Engineer

Alexis-Maurer is a co-creator of poutine and the architect behind Boost Security's large-scale cloud scanning infrastructure. He single-handedly created bagel, the open source developer workstation security scanner, and remains its core maintainer. He is also an active contributor to Dazio. A prolific Go developer, he wrote the majority of the codebase powering the team's automated vulnerability discovery systems.

CRISIS 2025 🇨🇦 Gatineau, QC Oct 22, 2025

Panel sur la Cybersécurité dans les chaînes d'approvisionnement

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

OWASP AppSec Days France 🇫🇷 Paris Sep 23, 2025

OWASP AppSec Days France 2025

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

Munich Cyber TTP (MCTTP) 🇩🇪 Munich Sep 17, 2025

Living Off the Pipeline: From Supply Chain 0-Days to Predicting the next XZ-like attacks

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

OWASP Montréal / Cybereco 🇨🇦 Montréal, QC Aug 28, 2025

Living Off the Pipeline / À l'Ombre du Pipeline

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

OpenSSF SOSS Community Day NA 2025 🇺🇸 Denver, CO Jun 26, 2025

Living Off The Pipeline: From Supply Chain 0-Days to Predicting the Next XZ-Like Attacks

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

PolySécure May 15, 2025

Teknik - Living Off the Pipeline: From Supply Chain 0-Days to Predicting the next XZ-like attacks

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

NorthSec 2025 🇨🇦 Montréal, QC May 15, 2025

Living Off The Pipeline: From Supply Chain 0-Days to Predicting the next XZ-like attacks

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

NorthSec 2025 🇨🇦 Montréal, QC May 15, 2025

AppSec Q&A

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

PolySécure 🇨🇦 Montréal, QC May 15, 2025

Spécial - Panel à NorthSec 2025

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

Cyberconférence Cybereco 2025 🇨🇦 Montréal, QC Apr 8, 2025

Panel sur la valeur du DevSecOps dans les processus de GIA

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

The Elephant in AppSec Mar 19, 2025

The Open Source Security Crisis: Is Trust the Weakest Link in Supply Chain?

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

Why do we keep ignoring CI security

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

DSO Overflow Jan 31, 2025

Securing the Software Supply Chain

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

### 2024

Arbitrary Code Execution 0-day in Build Pipelines

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

SecTOR (Black Hat Summit) 🇨🇦 Toronto, ON Oct 22, 2024

Under The Radar: How we found 0-days in the Build Pipeline of OSS Packages

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

OWASP Global AppSec 2024 🇺🇸 San Francisco, CA Sep 26, 2024

Under The Radar: How we found 0-days in the Build Pipeline of OSS Packages

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

FLOSS Weekly May 22, 2024

I'll Buy You A Poutine

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

PolySécure May 16, 2024

Teknik - Build Pipeline Supply Chain Attack

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

NorthSec 2024 🇨🇦 Montréal, QC May 16, 2024

Under the Radar: How we found 0-days in the Build Pipeline of OSS Packages

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

, Benoît Côté-Jodoin
Benoît Côté-Jodoin
Benoît Côté-Jodoin ex-Senior Product Security Engineer

Benoît was a co-creator of both poutine and the Living Off The Pipeline (LOTP) project. He contributed extensively to supply chain security research and built core tooling that powers Boost Security's vulnerability discovery capabilities.

OpenSSF SOSS Community Day NA 2024 🇺🇸 Seattle, WA Apr 15, 2024

Under the Radar: How We Found 0-Days in the Build Pipeline of OSS Packages

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

, Benoît Côté-Jodoin
Benoît Côté-Jodoin
Benoît Côté-Jodoin ex-Senior Product Security Engineer

Benoît was a co-creator of both poutine and the Living Off The Pipeline (LOTP) project. He contributed extensively to supply chain security research and built core tooling that powers Boost Security's vulnerability discovery capabilities.

### 2023

Cloudanix Oct 13, 2023

Shielding Software Supply Chain: Strengthening Security Measures

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

Actionable Software Supply Chain Security

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

NorthSec 2023 🇨🇦 Montréal, QC May 18, 2023

Broken Links: Behind the scenes of Supply Chain breaches

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

Wiz Webinar May 10, 2023

Cloudy with a Chance of Security: How Mid-Sized Organizations are Solving for 2023's Biggest Cloud Security Challenges

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

BSides NYC 🇺🇸 New York City, NY Apr 22, 2023

Broken Links: Behind the scenes of Supply Chain breaches

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

### 2022

BSides Montréal 🇨🇦 Montréal, QC Sep 10, 2022

2021 – The Year Of Supply Chain Breaches

François Proulx
François Proulx
François Proulx CTO

François is the CTO of Boost Security, where he continues to lead the security research team. He co-created the poutine Open Source CI/CD scanner and co-founded the Living Off The Pipeline (LOTP) project to describe the abuse of build tools for lateral movement. After spending years teaching defenders how to secure their workflows, he is now demonstrating how attackers are dismantling them, most recently with SmokedMeat, the open source red team framework for CI/CD pipelines.

, Zaid Al Hamami
// abstract