Addendum: Corregí mi propio instrumento y el número bajó de 807 a 612

An addendum to the article "The $6.3B hack wasn't a code bug" (Dev.to, published 30-Oct-2026) reveals that 612 observations were made of ten repositories, down from the initial 807 count. The reduction is due to the correction of two domain errors, not two thresholds. Prior to the correction, GATE_RC_4_SECRETO_EXPUESTO measured usage, marking secrets.* in env: —global or job—, and with:.

This was the correct way to deliver a secret to a step without it appearing in the script body. GATE_RC_2_SUMIDERO.impudo treated the absence of a download-artifact as a sumidero, but a job with id-token: write that didn't materialize a tree, didn't invoke a dynamic tool, and didn't restore cache didn't execute anything, making the invariant true by emptiness.

The domain was corrected to measure the presence of a tree or its dependencies (checkout, npx/pipx, or actions/cache instead of an artifact). The exact numbers before and after show that observations from gate 596 remained the same, but SC1_* (permission surface) and RC 2 (undeclared sumidero) dropped from 211 to 211 and 76 to 30, respectively.

The total count went from 807 to 612, with 195 observations eliminated (149 from RC 4 and 46 from RC 2). The correction removed noise, not criteria, and the falsifier's position remained unchanged: 10 of 10 repositories still had at least one conjunction of authority, and the falsifier's three readings (A 10/10, B 6/10, C 4/10) remained identical.

The instrument was updated to fix the issue; the thesis still stands on the same code as before the correction. The method used to validate the correction includes a pre-registered prediction, a census of the surface (RC 4 = 3 and RC 2 = 30), and three negative controls that fail the old behavior: env: with secrets, with: with third-party code, and a job without a tree, dynamic tool, or cache.

The TPR (true positive rate) for RC 2 and RC 4 has been measured and is now 3 and 30, respectively. A self-test added 8 new cases, bringing the total to 11 (RC 0). The control group size, previously reported as 612, is now 612, making the study more accurate. The updated prediction showed 596 + 211 = 807 observations before the correction.

The motor that published its own count cannot measure its own correction. The control observation of RC 4 now states 3 findings, and the control observation of RC 2 remains at 30. The prediction was accurate, with 401 gate findings reproduced on the corrected bytes. Of the 33 residual RC 2 findings, 20 only emit the actions/checkout message, which is a valid way to handle third-party code in OIDC workflows. The rest of the findings belong to other classes, not previously predicted by the prediction.