# An Ode to Defense in Depth

DevFeed: [An Ode to Defense in Depth](<https://devfeed.tech/articles/an-ode-to-defense-in-depth-12870.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/an-ode-to-defense-in-depth>)

Published: 2025-03-17T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [automation](<https://devfeed.tech/tags/automation.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [defense-in-depth](<https://devfeed.tech/tags/defense-in-depth.md>), [github](<https://devfeed.tech/tags/github.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [renovate](<https://devfeed.tech/tags/renovate.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [spoof](<https://devfeed.tech/tags/spoof.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [team](<https://devfeed.tech/tags/team.md>)

## AI overview

Chainguard describes how a March 14, 2025 supply chain attack compromised tags in the tj-actions/changed-files GitHub repository, causing a malicious commit to dump action-runner memory and potentially expose secrets. The article outlines Chainguard's defense-in-depth response, including blocking affected updates, suspending some automation, checking affected repositories, contacting customers and maintainers, and treating build systems like production systems.

## Source excerpt

Chainguard's defense in depth approach to security helped protect it from the recent tj-actions/changed-files GitHub repository compromise. Learn more about how.