Mintlify GitHub read/write token leak
mintlify.com
Mintlify GitHub read/write token leak
1–10 of 45 posts
Re: Mintlify GitHub read/write token leak
#2I'd been interested in Mintlify and their documentation platform for a while.
I saw this pop up based on this Reddit thread and on Twitter as well:
https://www.reddit.com/r/ExperiencedDevs/comments/1bf7eqa/ni...
This seems serious? Is this really serious?
Why would they need to save these tokens in the first place?
Re: Mintlify GitHub read/write token leak
#3I'd been interested in Mintlify and their documentation platform for a while. I saw this pop up based on this Reddit thread and on Twitter as well: https://www.reddit.com/r/ExperiencedDevs/comments/1bf7eqa/ni... This seems serious? Is this really serious? Why would they need to save these tokens in the first place?
If they're a GitHub App, they receive a token to authenticate into your account/org when you grant them access/enable the app.
Everyone should audit their GitHub Apps periodically/avoid using them if at all possible IMO. Most of these integrations are just a convenience for adding webhooks, which you can do yourself without compromising security. Always prefer "outbound" integrations.
Re: Mintlify GitHub read/write token leak
#4I'd been interested in Mintlify and their documentation platform for a while. I saw this pop up based on this Reddit thread and on Twitter as well: https://www.reddit.com/r/ExperiencedDevs/comments/1bf7eqa/ni... This seems serious? Is this really serious? Why would they need to save these tokens in the first place?
It’s super serious …
Re: Mintlify GitHub read/write token leak
#5SOC 2 compliant. Tells you exactly how useful SOC compliance is.
Re: Mintlify GitHub read/write token leak
#6SOC 2 compliant. Tells you exactly how useful SOC compliance is.
All SOC tells you is that there is a process being (mostly) followed. Always review the reports for your vendors and follow up on any findings or gaps that show up.
It's surprisingly common for places to be SOC compliant, yet their latest report has half a dozen or more gaps/findings.
Re: Mintlify GitHub read/write token leak
#7This opens the door for supply chain attack. Removing mintlify and auditing other integrations ASAP should be considered as #1 priority.
Re: Mintlify GitHub read/write token leak
#8I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding.
For customer OAuth tokens, I believe you should NEVER store the access token in the database. Only store the refresh token in the database. When you need api access, get a new access token with the refresh token and client secret.
This prevents incidents like the above as the attacker would also need your client secret, which is ideally not in your database.
Re: Mintlify GitHub read/write token leak
#9SOC 2 compliant. Tells you exactly how useful SOC compliance is.
[deleted]
Re: Mintlify GitHub read/write token leak
#10Mintlify sponsors one of my open source projects, express-rate-limit, and we use their service to host the docs for it. So I'm probably biased, but I've honestly been pretty happy with it overall - I'm thinking about using it for some of my other projects.
I think the best thing I can say about it is this: Mintlify helps us write better docs. Before Mintlify, we had a humongous readme plus a few one-off articles in the wiki. After switching the Mintlify, we started organizing things better, beginning with a less overwhelming readme.
I found out about this hack when they sent me an email yesterday. I looked through the git history (edit: and github activity), but nothing seems awry.
It sucks, but they're a pretty small business, and I think they're handling it reasonably well.