5 ms·
Github has a feature to allow access to a singular repository via a key. It would be logical for CircleCI to use that feature, although I'm not sure they actual
by xentronium 13y ago
Github has a feature to allow access to a singular repository via a key. It would be logical for CircleCI to use that feature, although I'm not sure they actually did.
https://help.github.com/articles/managing-deploy-keys#deploy-keys https://help.github.com/articles/managing-deploy-keys#deploy...
- gravitronic 13y agoThey did not.
- j15e 13y agoThey did, Circle-CI client here. Info have a Circle-CI deploy key per private repository (which I will revoke).
- johnwards 13y agoI'm pretty sure that Circle uses the oAuth api to checkout repos, the deploy key part on github they use for their deployment feature. If the attacker has a bunch of tokens, could they have bulk downloaded source code before the oAuth stuff was revoked by Circle? https://github.com/blog/1270-easier-builds-and-deployments-using-git-over-https-and-oauth https://github.com/blog/1270-easier-builds-and-deployments-u...