TruffleHog & Slack: GitHub Token Security Nightmare! #shorts

Truffle Hog, if you've never played around with it, I highly recommend it. And so, something else that's great about Slack, the API will let you search for text in screenshots. And so, some developers at Square a screen shared a screenshot. The screenshot had a GitHub access token in the screenshot somewhere. And so, that boom. Now they've got access to GitHub as a developer. They've stolen this second identity. Uh there was a legacy access token as well in GitHub, which don't expire and have the full privileges of that user. So, now they go in, they clone all the private repos, they keep reading the freaking manual, and they learn more and more about the environment. Oh, by the

way, now that 24-hour time, that's they don't have to worry about that. They've got access.