Unfortunate, but impressed by how the Mintlify team is handling it.
Mintlify GitHub read/write token leak
21–30 of 45 posts
Re: Mintlify GitHub read/write token leak
#22SOC 2 compliant. Tells you exactly how useful SOC compliance is.
An artificial barrier to entry. What a racket.
Re: Mintlify GitHub read/write token leak
#23Unfortunate, but impressed by how the Mintlify team is handling it.
Even something as simple as bolding the message about customer repositories being accessed is nice. Not trying to bury the lead.
Re: Mintlify GitHub read/write token leak
#24I reported security issues to Mintlify back when they used Discord for support. Gave recreation steps. Never got any feedback that looked to me like they were looking into it.
I reported similar issues to what's described in May 2023.
Re: Mintlify GitHub read/write token leak
#25I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding. For customer OAuth tokens, I believe you should NEVER store the access token…
This is pretty typical of GitHub, unfortunately. They have terrible scoping and don't give developers the option to even give users that flexibility. It's been like this for over a decade, I don't think GitHub will ever learn.
Re: Mintlify GitHub read/write token leak
#26I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding. For customer OAuth tokens, I believe you should NEVER store the access token…
This is pretty typical of GitHub, unfortunately. They have terrible scoping and don't give developers the option to even give users that flexibility. It's been like this for over a decade, I don't think GitHub will ever learn.
Wrong. “GitHub Apps” always (?) had fine-grained repo-scoped permissions, it’s the “OAuth apps” that are stuck with coarse-grained permissions. So developers do have the option, it’s even the preferred option.[1]
> In general, GitHub Apps are preferred over OAuth apps.
[1] https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...
Re: Mintlify GitHub read/write token leak
#27Earlier quoted context omitted.
This is pretty typical of GitHub, unfortunately. They have terrible scoping and don't give developers the option to even give users that flexibility. It's been like this for over a decade, I don't think GitHub will ever learn.
Wrong. “GitHub Apps” always (?) had fine-grained repo-scoped permissions, it’s the “OAuth apps” that are stuck with coarse-grained permissions. So developers do have the option, it’s even the preferred option.[1] > In general, GitHub Apps are preferred over OAuth apps. [1] https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...
"Always" is doing a lot of work here. Github Apps are relatively new.
Re: Mintlify GitHub read/write token leak
#28"we cannot confirm that no other such instances occurred". I'd like to understand this more. Do they 1. not have a fingerprint of what the exploit looked like because it was indistinguishable from customer behavior? 2. Not have logging necessary to audit this? Regardless, with the added monitoring to detect suspicious activity, do they also have the logging to see everything a bad actor did if there is a new exploit?
Re: Mintlify GitHub read/write token leak
#29Did I miss it or does the announcement completely evade explaining HOW the tokens actually leaked?
Re: Mintlify GitHub read/write token leak
#30I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding. For customer OAuth tokens, I believe you should NEVER store the access token…
Too generous permissions are something that often makes me not install software. Zoom apps for example. Slack apps another example. Mostly browser extensions.
The browser extension permission model is so bad. It’s prevented me from using 99% of extensions I was interested in.