Stolen OAuth tokens: review your GitHub apps
Attackers used tokens stolen from Heroku and Travis CI to download private GitHub repos. Check who can read your code.
GitHub said last week that an attacker used stolen OAuth tokens, issued to Heroku and Travis CI, to download private repositories from dozens of organisations, including npm. GitHub itself wasn’t hacked. The keys came from apps that customers had connected to it.
Every “Sign in with GitHub” or “Connect your repository” creates a token with access to your code. Those tokens live on someone else’s servers.
What to do now:
- Review authorised OAuth apps and GitHub Apps for your account and organisation. Remove what you don’t use.
- Check the scopes. Does a deploy tool really need access to every private repo?
- Look at your organisation’s audit log for clones and downloads you can’t explain.
- Rotate secrets that live in your repositories. If private code was copied, keys inside it are exposed.
- Turn on organisation policies that require admin approval for new third-party apps.
Your code is only as private as the least careful app you connected to it.