3 ms·
The bigger question to me is how did they leverage a GitHub OAuth token to gain access to an internal database unless they're storing that config in their codeb
by jeremymcanally 4y ago
The bigger question to me is how did they leverage a GitHub OAuth token to gain access to an internal database unless they're storing that config in their codebase.
If that's the case...yikes.
- jeremyjh 4y agoThey didn’t say that happened. I’m reading it as their DB was compromised and it’s contents included GH auth tokens.
- jeremymcanally 4y agoHow do you read this as the database had tokens in it? > Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database... EDIT: Ah yep you're right. Two tokens in play there: one Heroku API token, one GitHub token. Phew.