Here's how a researcher broke into Microsoft VS Code's GitHub
Researcher RyotaK discovered a vulnerability in the VS Code’s Continuous Integration (CI) script that let him break into Microsoft VS Code’s official GitHub repository and commit files.
