> the Tanstack compromise is very likely to have been the leak vector ....appears to have been backdoored to extract an API key with authorization to read the

> the Tanstack compromise is very likely to have been the leak vector ....appears to have been backdoored to extract an API key with authorization to read the private codebase. ... > immediately rotated all required tokens & credentials to prevent further incidents. Rotating the API key doesn't quite put them in a position to "prevent further incidents" does it? The next PyPI/npm supply chain issue will just get the new key? I suppose whatever they use that key for should be reviewed and re-scoped if possible? Does github let you restrict where you can originate requests using a given API key? or are we just not there yet?