Branch protection worked. It lasted five seconds
On 21 October 2026, at 10:08:29 UTC, GitHub branch protection rejected a change to LiteLLM's release workflow. At 10:08:34 a privileged credential overrode it and applied the change anyway. Ninety minutes later there were seven poisoned litellm 1.107.0 wheels on PyPI. No control failed: all three were satisfied, because all three asked the same question. With the minute-by-minute timeline from the official report, why the blast radius is not the applications that use the library but any virtualenv where it is installed, the real 2-hour-40-minute window, and seven checks with the exact commands.
Microsoft 365
ES 
CAT 
EN