Letra ChicaSecurity● verified 34 days ago◌ no external reviewer
Without attribute_condition, GitHub's shared issuer lets any repo in
GitHub uses one issuer for all its customers, so validating the issuer isn't enough. Google requires a condition restricting tokens to your organization or repository. In Terraform the field is listed as optional and, without a condition, every valid credential from the issuer is accepted. Also, every claim you use in the condition or in a principalSet must be mapped in attribute_mapping.