Alejandro Rusell

Senior Cloud Security Engineer @ Miro

Alejandro Rusell is a Cloud Security Engineer focused on designing and operating secure cloud infrastructure at scale, currently working in Berlin as Senior Cloud Security Engineer at Miro. His experience over the past decade spans different technical roles: Staff Security Engineer on the Cloud Security Team at Trade Republic, Security Engineer at OLX Group, and, prior to that, Technical Leader at Avature. Earlier in his career, he served as Information Security Manager at the Ministry of Justice and Human Rights of Argentina, and as an Information Technology and Security Architect at a company of Grupo BAPRO. He has made minor contributions to OWASP Top Ten 2010, and co-organized Agile Open Bs. As. Seguridad in 2013, 2014, and 2015.

The GitHub OIDC Trust Problem: When You Trust the Wrong String

Friday, 13 November 2026, 11:10 - 11:50

Everyone tells you to replace long-lived CI/CD credentials with OIDC, and for good reason: a short-lived, per-run token beats a static key sitting in a secrets manager. But GitHub Actions ships one property that quietly undermines the fix: GitHub itself is the OIDC issuer for every workflow on the platform, yours and everyone else's, and it authenticates all of them exactly the same way. Authentication is basically a given, as the token's signature will validate no matter which workflow requested it. The real security decision scopes down to authorization: how your cloud provider processes the claims inside that token. That's where the structural blind spot is.

GitHub builds the identity claim as a multi-segment value, gluing together organization, repository, branch, and workflow information. AWS's trust-policy engine, and its equivalents elsewhere, validates the whole thing as one opaque string. A wildcard doesn't know where one piece of information ends and the next begins, and that's exactly the gap behind the wildcard-trust-policy findings that keep surfacing in the wild.

This talk gives you the mental model for why that keeps happening, walks through GitHub's and AWS's changes during 2026 to how identity is expressed and validated, and shows precisely which parts of the problem they do and don't fix, with a demo of building and matching a vulnerable trust policy, not just slides. You'll leave knowing exactly what pattern to grep your own trust policies for tonight.