Top all-time · #3821
Codecov
Company blog · about.codecov.io/blogprogrammingsecurity
Codecov is the company blog at about.codecov.io, writing about programming and security. Since 2021, 19 different Hacker News readers have linked it 22 times, most often “CodeCov is now Open Source”. No feed was found, so read it on the site itself.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers mostly link Codecov's about pages as sources for its security-update notices about the CI secrets breach, plus its open-source announcement and a post arguing against 100% code coverage.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Ship high-quality code & spend less time debugging. Improve developer workflow, re-run flaky tests, & track JavaScript bundle size. Learn about our code quality & coverage tool here.
Most-linked posts?
- /security-update/4 people · 4 mentions · first linked 2021-04-17
- CodeCov is now Open Source2 people · 2 mentions · first linked 2023-08-02
- Codecov Is Joining Sentry2 people · 2 mentions · first linked 2022-12-01
- A New Chapter for Codecov2 people · 2 mentions · first linked 2026-06-02
What Hacker News says?
I don't know, it looks like pure bullshit to me. Under their customer profile for Google there is just a random blog post about how to setup their garbage for Kotlin. https://about.codecov.io/blog/company/google/
Comment linking /blog/company/google/
on “Codecov breach impacts GoDaddy, Atlassian, P&G etc.”Submitted Codecov Bash Uploader compromised as a story · 198 points
HN discussionHere’s the notice I got: https://about.codecov.io/security-update/
Comment linking /security-update/
on “Codecov breach impacts GoDaddy, Atlassian, P&G etc.”Submitted CodeCov is now Open Source as a story · 42 points
HN discussionSee the codecov incident, where exactly this happened: https://about.codecov.io/security-update/
Comment linking /security-update/
on “Deno 2.4”Submitted Codecov releases Impact Analysis to public beta as a story · 11 points
HN discussionPeople often claim that open source is more secure, which is implied in this release. But the CodeCov breach that leaked any secrets provided to CI/CD pipelines [1] was done via a bash script available to anyone to read the code. The breach wasn't complex at all. It was just that nobody noticed for a long time that the bash uploader script sent all secrets to a random IP address. It makes me wonder what the benefit…
Comment linking /security-update/
on “CodeCov is now Open Source”Submitted Codecov Bash Uploader Security Event Post-Mortem / Root Cause Analysis as a story · 3 points
HN discussionTom from Codecov here. This is so true, 80% is usually a much more reasonable approach. It’s better to write good tests than all the tests. (Shameless plug) I wrote a short post about this here: https://about.codecov.io/blog/the-case-against-100-code-cove...
Comment linking /blog/the-case-against-100-code-coverage/
on “Launch HN: Sweep (YC S23) – A bot to create simple PRs in your codebase”Submitted 2020 State of Open Source Code Coverage as a story · 3 points
HN discussionCodecov's recent security breach[1] wasn't noticed for three months, and was caught by someone checking the shasum[2]. While it's best practice to validate the checksum on every download yourself, people obviously aren't doing that. I made a small website where you can see that at least someone is checking these things: https://www.hecksum.com/ . It's a rushed-out-the door MVP. There are only two projects supported,…
Comment linking /security-update/
on “Show HN: Hecksum. Validating checksums so you don't get Codecoved for 3 months”Submitted Getting Started with Code Coverage for Golang as a story · 3 points
HN discussionFollow up from the earlier thread "CodeCov is now Open Source": https://about.codecov.io/blog/codecov-is-now-open-source/ and related discussion on HN: https://news.ycombinator.com/item?id=36971490
Comment linking /blog/codecov-is-now-open-source/
on “Let's Talk About Open Source”Submitted A New Chapter for Codecov as a story · 2 points
HN discussionBlog post from Codecov https://about.codecov.io/blog/a-new-chapter-for-codecov/
Comment linking /blog/a-new-chapter-for-codecov/
on “Harness Acquires Codecov from Sentry”Submitted Codecov Is Joining Sentry as a story · 2 points
HN discussionSubmitted Codecov is Joining Sentry as a story · 2 points
HN discussionSubmitted Codecov Product Update: Browser Extension as a story · 1 points
HN discussionSubmitted Message Regarding the PyPI Package as a story · 1 points
HN discussionSubmitted Reflections on the 32-hour Work Week at Codecov as a story · 1 points
HN discussionSubmitted How to Incorporate Code Coverage for a Legacy Application – Codecov as a story · 1 points
HN discussionSubmitted JavaScript Code Coverage Using GitHub Actions and Codecov as a story · 1 points
HN discussion
