Attack campaign involving stolen OAuth tokens issued to third-party integrators

Re:Attack campaign involving stolen OAuth tokens issued to t... by judge2020 on Saturday April 16, 2022 @01:16AM (#31049702)

All the oauth prompts I’ve gotten in the past 3 years or so seem to have the granular per-repo control you’re looking for.

[ Parent | on HN ]

Re:Attack campaign involving stolen OAuth tokens issued to t... by media-trivial on Saturday April 16, 2022 @04:33AM (#31050712)

Only "app installations" from the GitHub marketplace can be limited to specific repositories. For OAuth apps this is not possible sadly (everything that uses GitHub to login or connect accounts, e.g. Travis CI, Terraform Registry, Heroku).

[ Parent | on HN ]