HashiCorp Terraform Security Update

Recommended Actions - Update your Terraform and CodeCov software ASAP Synopsis Late last week it was brought to our attention that CodeCov suffered an attack in which attackers gained access to their bash uploader script and modified it without CodeCov’s permission. This enabled hackers to modify the script and monitor data as it was uploaded to CodeCov including secrets, that were used in the CI pipeline. HashiCorp uses CodeCov’s uploader and as a result, their GPG signing key was exposed.