安全摄像头登录页面泄露了GitHub管理员令牌，暴露出固件供应链的重大安全隐患。
Article URL: https://hhh.hn/hanwha-github-token/ Comments URL: https://news.ycombinator.com/item?id=49034292 Points: 478 # Comments: 166
沙箱访问外部服务时自动注入GitHub令牌等凭据，秘密不可读，未注入主机可盲隧道转发，安全又省心。
Article URL: https://github.com/yagop/sandbox Comments URL: https://news.ycombinator.com/item?id=48784755 Points: 2 # Comments: 0
开发者必看：GitHub token在机器重建后仍存活，黑客利用Azure IP劫持仓库，揭示2FA的隐蔽盲区。
How the lockout ended, the entry vector GitHub confirmed, the stealth commits I missed at first, and the cleanup playbook for anyone hit by the same w…
点击链接就能窃取GitHub令牌？VSCode Webview安全漏洞深度解析，附PoC及防护方案。
Article URL: https://blog.ammaraskar.com/github-token-stealing/ Comments URL: https://news.ycombinator.com/item?id=48371562 Points: 314 # Comments: 42