4 ms·

Baseten carries the Soc 2 Type II and HIPAA Compliant logos on its front page. They also have logos for customers including: OpenEvidence (medical related, use

Baseten carries the Soc 2 Type II and HIPAA Compliant logos on its front page. They also have logos for customers including: OpenEvidence (medical related, used by almost 2/3 of physicians in the US, claim HIPAA compliance), Harvey (legal related, claim "binding terms on data protection, data access, incident response SLAs, and other controls aligned with SOC2, ISO, GDPR and other standards.") From TFA: > That token had admin and push access to Baseten's main product repo, the GitOps repo that drives their clusters, and their Homebrew tap, plus read/write access to other private repositories including specific repos per customers. > The image build dated to March 2023, and the token still worked when we found it in July 2026. What are the legal implications here?

conception 19d ago
Unless github had regulated data, unlikely, the legal implications are few. Document the issue, remediate and no findings on the next audit. Done.
hmokiguess 19d ago
Given the build is from 2023 one would expect that at least the token would have been rotated, and I suspect some of these compliance checks do require rotation of tokens/passwords. That said, the whole compliance industry is a joke.
- icedchai 19d ago
  Box checking is an important business!
  - antonvs 19d ago
    I can’t help noticing that an LLM can check boxes.
- fragmede 19d ago
  tokens yes, password rotation, no. In 2017: > NIST changed the guidance with SP 800-63B, published June 2017. It explicitly said: "Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)." Instead, passwords should be changed when there is evidence they have been compromised, not every 30/60/90 days.
- jacquesm 18d ago
  I tried to open a conversation with an entity that issues ISO27001 certificates about the stuff I had found at a company they had recently certified. The response was such that I have lost faith in that entire industry. It's essentially a well dressed up pay-to-play.
  - hmokiguess 17d ago
    Totally, it's really a whole bunch of theatre to sustain an economy of leeches and middleman on your margins.

conception 19d ago

Unless github had regulated data, unlikely, the legal implications are few. Document the issue, remediate and no findings on the next audit. Done.

hmokiguess 19d ago

Given the build is from 2023 one would expect that at least the token would have been rotated, and I suspect some of these compliance checks do require rotation of tokens/passwords. That said, the whole compliance industry is a joke.

icedchai 19d ago
Box checking is an important business!
- antonvs 19d ago
  I can’t help noticing that an LLM can check boxes.
fragmede 19d ago
tokens yes, password rotation, no. In 2017: > NIST changed the guidance with SP 800-63B, published June 2017. It explicitly said: "Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)." Instead, passwords should be changed when there is evidence they have been compromised, not every 30/60/90 days.
jacquesm 18d ago
I tried to open a conversation with an entity that issues ISO27001 certificates about the stuff I had found at a company they had recently certified. The response was such that I have lost faith in that entire industry. It's essentially a well dressed up pay-to-play.
- hmokiguess 17d ago
  Totally, it's really a whole bunch of theatre to sustain an economy of leeches and middleman on your margins.