News for hackers. Stuff that matters.

A comment on Mintlify GitHub read/write token leak.

Re:Mintlify GitHub read/write token leak by 11217mackem on Saturday March 16, 2024 @07:07PM (#39730256)
I'd been interested in Mintlify and their documentation platform for a while.

I saw this pop up based on this Reddit thread and on Twitter as well:

https://www.reddit.com/r/ExperiencedDevs/comments/1bf7eqa/ni...

This seems serious? Is this really serious?

Why would they need to save these tokens in the first place?

[ Parent | on HN ]
Re:Mintlify GitHub read/write token leak by candiddevmike on Saturday March 16, 2024 @08:13PM (#39730635)
If they're a GitHub App, they receive a token to authenticate into your account/org when you grant them access/enable the app.

Everyone should audit their GitHub Apps periodically/avoid using them if at all possible IMO. Most of these integrations are just a convenience for adding webhooks, which you can do yourself without compromising security. Always prefer "outbound" integrations.

[ Parent | on HN ]
Re:Mintlify GitHub read/write token leak by akaike on Saturday March 16, 2024 @08:18PM (#39730668)
It’s super serious …
[ Parent | on HN ]