Ruepler

Exactly. You'd need to implement standard authentication mechanisms, preventing these vectors of attack from existing in the first place.

They are "in the process" and "looking" to do that. As of now if I am not mistaken the main issue still persists and any other new security vulnerability will possibly give full access to tokens again.

Correct me if I am wrong please but I don't see anything in the comment or Blog post saying otherwise.

> and are also in the process of completely deprecating the admin tokens for a more secure internal authentication procedure. Not to mention, we're also looking to fully deprecate the need of the GitHub OAuth tokens entirely in the coming weeks.

https://www.reddit.com/r/cscareerquestions/comments/1bh22bq/...

You can for sure. I am using it with Cloudflare pages for example. It's a matter of a click.

It's most likely not. Not sure if this was intentional but they pretty much confirmed it in a reddit thread:

> ... and are also in the process of completely deprecating the admin tokens for a more secure internal authentication procedure. Not to mention, we're also looking to fully deprecate the need of the GitHub OAuth tokens entirely in the coming weeks.

https://www.reddit.com/r/cscareerquestions/comments/1bh22bq/...

>"we've decided to leave out the technical details of the breach in the blog post"

>"Our dedication to transparency, security, and the trust you place in us remains unwavering."

You are contradicting yourself here.

>"The source of this security incident was due to an uncaught error response in one of our APIs that didn't properly format the response before sending it back to the client. The response contained our internal admin tokens, which can then be used to access internal endpoints, which unveiled sensitive user information."

Why would you leave that out? Seems like it is vital information.

They are claming that they resolved the vulnerability that caused the token leak but don't mention it. Doesn't exactly seem transparent to me or like handling it well.

I was contracting for them last year and tried, among other things to build an actual engineering culture that prevents and fixes issues that accumulate to catastrophic incidents like this.

They generally prefer to "ship fast".

I informed them very thoroughly again on January 13th (3+ months after they terminated me for "cultural differences"), because I was worried of this exact nightmare scenario happening very soon.

The reason for this was that they open sourced a package that let's an attacker easily practice and test locally in like a minute.

MDX exposes to Cross site Scripting easily. I assume this is the "fixed vulnerability" they are talking about, just to be transparent.

Yea it does. It most likely is related to MDX documents beeing susceptible to XSS attacks. Having worked at mintlify last year I can tell you that this is not surprising at all and I've been warning them extensively of sth like this happening.