[dead]
Mintlify GitHub read/write token leak
11–20 of 45 posts
Re: Mintlify GitHub read/write token leak
#12SOC 2 compliant. Tells you exactly how useful SOC compliance is.
Auditors don't get paid to fail their customers ;) I think many people would be surprised just how.. Accommodating the process can be.
Re: Mintlify GitHub read/write token leak
#13I really like mintlify and I found this writeup to be straightforward and responsible. Shit happens.
Re: Mintlify GitHub read/write token leak
#14So a user (or white hat?) alerts them to security issue on their endpoint. Email comes in at 4:55 PDT on a Friday.
[first red flag] No internal monitoring to check for unauthorized access
Poor engineer(s) tasked with issue on a Friday at end of work day manually rakes logs in their app. After ~1 hr of searching, discovers unauthorized device using leaked credentials
[second red flag] allows any device to hook into their critical infrastructure and access apis that have potential to expose PII and possibly move laterally within the org or customers.
Then poor engineers tasked with painstaking task to rotate all of the tokens throughout the night. Bye bye family time, any planned events (game tickets?). I hate this company already and I have no clue wtf they do.
[third red flag] why the fuck are they storing user tokens in a database. This is apparently a “SOC 2” certified application/company. Shows how much that is worth here.
[edit: fourth red flag] no indication of how long the unauthorized credentials have been used and what customers have been impacted. Very very piss poor logging or purposely omitting due to potential litigation issues
Probably missed a few but this is bad.
The “S” in Mintify clearly stands for security.
Re: Mintlify GitHub read/write token leak
#15Mintlify sponsors one of my open source projects, express-rate-limit, and we use their service to host the docs for it. So I'm probably biased, but I've honestly been pretty happy with it overall - I'm thinking about using it for some of my other projects. I think the best thing I can say about it is this: Mintlify helps us write better docs. Before Mintlify, we had a humongous readme plus a few one-off articles in t…
> I looked through the git history, but nothing seems awry.
Git history or GitHub event history? You can easily push a malicious commit forged to have the same author and short hash.
Re: Mintlify GitHub read/write token leak
#16SOC 2 compliant. Tells you exactly how useful SOC compliance is.
Broadly speaking, being SOC 2 "compliant" isn't really a thing. They just had a SOC 2 audit done, you have to read the report to discover how "compliant" they are.
SOC 2 is useful as setting a baseline for how a business and IT org should be ran, assuming it's followed...
Re: Mintlify GitHub read/write token leak
#17I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding. For customer OAuth tokens, I believe you should NEVER store the access token…
[deleted]
Re: Mintlify GitHub read/write token leak
#18Mintlify sponsors one of my open source projects, express-rate-limit, and we use their service to host the docs for it. So I'm probably biased, but I've honestly been pretty happy with it overall - I'm thinking about using it for some of my other projects. I think the best thing I can say about it is this: Mintlify helps us write better docs. Before Mintlify, we had a humongous readme plus a few one-off articles in t…
> I looked through the git history, but nothing seems awry. Git history or GitHub event history? You can easily push a malicious commit forged to have the same author and short hash.
Good point. I only looked through the git history initially, but I've now looked through both. Same conclusion.
Re: Mintlify GitHub read/write token leak
#19I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding. For customer OAuth tokens, I believe you should NEVER store the access token…
Too generous permissions are something that often makes me not install software. Zoom apps for example. Slack apps another example. Mostly browser extensions.
Re: Mintlify GitHub read/write token leak
#20Oof not a fun incident, this is my nightmare as someone who works on this type of stuff.
As an aside, GitHub’s security model for apps/integrations is extremely puzzling to reason about and enables a lot of foot guns. Add the fact that it’s very obtuse to audit integrations (especially within an organization) makes them pretty scary to use sometimes.