3 ms·
Based on their incident report, it sounds more like someone gained access to the OAuth tokens used to authenticate with linked GitHub repos, which would actuall
by drusepth 5y ago
Based on their incident report, it sounds more like someone gained access to the OAuth tokens used to authenticate with linked GitHub repos, which would actually be both read _and_ write access to all source code of repos linked to Heroku apps.
RE kids or misdirection: as with all things, it's probably somewhere in the middle -- a somewhat-sophisticated attacker and a slow, evolving investigation unfortunately coinciding with a holiday weekend. They say the report was received 3 days ago (on April 13) from GitHub after they noticed suspicious activity on April 9.