Haha, I hear ya. I hear rumors of rumors even in the single small chat I'm in. lol

There's also a few unofficial Signal channels floating around depending on who you know

That's sucks, sorry to hear that. Good luck with her recovery.

The Argo team has to consider that type of scenario with these disclosures and not assume everyone is following best practices. Hell, if everyone followed best practices so many CVEs would be a much lower severity due to defense in depth

That's all it should be but you never know what someone is doing. What if someone is running some HR/finance system deployment on the same Argo CD as something else & stores credentials to that system in their git repo because it's private? They shouldn't do that but we all know people do it anyway.

Not really. There are companies that provide multi-tenant Argo CD services. Even within the same company there can be very strict requirements on access to code repos between teams for security or other reasons.

IDK, normally I'd agree with you, but this is a multi-tenancy thing. This is the equivalent of some read only GitHub token being able to access your private GitHub repo. That would be considered a 10, right?

Isn't that, you know, like, illegal?!?