Integration token scope Third-party token abuse
GitHub integrations: stolen tokens exposed private repositories
- Incident
- April 2022
- Source report
What was reported
GitHub reported that attackers used stolen OAuth tokens from Heroku and Travis CI integrations to download private repositories belonging to dozens of organizations. The attackers listed organizations and selectively cloned repositories. GitHub said it did not believe the tokens were obtained through compromise of GitHub’s own systems.
Our perspective
Our reading: Connecting a tool establishes continuing authority. The useful boundary is what it can retrieve later, not only what someone shared during setup. AI integrations need that same scrutiny.
Try Vivendur in actionLimits of this connection
The disclosure concerns third-party OAuth tokens, not an AI incident. Revocation ends future token access but cannot recover repository contents already downloaded.