Attack campaign involving stolen OAuth tokens issued to third-party integrators

Re:Attack campaign involving stolen OAuth tokens issued to t... by daenney on Saturday April 16, 2022 @09:14AM (#31052048)

Unfortunately no. GitHub Apps can be scoped to a repo, GitHub OAuth tokens cannot. A lot of things fall in the second category.

You’ll also discover this if you try to create a personal access token, it’s all repos, you can’t limit them to a particular repo.

[ Parent | on HN ]

Re:Attack campaign involving stolen OAuth tokens issued to t... by lmeyerov on Saturday April 16, 2022 @10:21AM (#31052548)

Disturbingly, their own products like azure dev portal largely push you into such a grant-universal-access-for-every-contributor path

Their sec org is impressive, so these occasional massive things have been surprising

[ Parent | on HN ]