5 ms·
Pretty sure (don't quote me) those are read only and repo specific but that could contain all sorts of juicy info depending how lax you are with security of con
by lugg 7y ago
Pretty sure (don't quote me) those are read only and repo specific but that could contain all sorts of juicy info depending how lax you are with security of configs in private repos.
Even then just read access to code often allows enough info for leveraging/escalating privilege.
- buzer 7y agoWhen you connect your Github account to Docker Hub, that will give DH full access to all repos (https://i.imgur.com/4jJWrez.png https://i.imgur.com/4jJWrez.png). I'm not even sure if Github's permission model supports adding only read access to private repositories. I'm not 100% sure if Docker hub uses deploy keys for repos it has access to thru the integration, but at least previously there was an option to manually add one to repository if it couldn't access it otherwise.
- rkrzr 7y ago> I'm not even sure if Github's permission model supports adding only read access to private repositories. Their newer GH apps permission model allows fine-grained access to only specific repos (and also only read access e.g.). However their older Oauth flow only allows full access to everything. And 99% of GH integrations still seem to use the older authentication method. This is also something that many CI providers suffer from. There are only few that already support GH apps.
- martinlofgren 7y agoI tried to give an user read-only access to a private repository on GitHub a few weeks ago, and from what I could tell it isn't possible.
- thinkmassive 7y agoDid you look under Settings > Collaborators?
- martinlofgren 7y agoYep, it's only possible to give full access there. No read only.