We were (and still are) considering them as an inference provider and did a quick check first... but kudos to their team for the fast patch

We really are entering the AI economy.

Now if only we knew if the stonks would go up or down (due to global turmoil) before I throw my savings at the SPY

…by finding an admin token in logs.

So often recent breaches involve Github in one way or another. How is it still considered a sane choice to host anything proprietary there? If your business is built around open source, ok, put a mirror on Github. But CI/CD, gitops, FDEs' stuff have no place on a public cloud. C-level execs may not know bits from bytes, but by now they should've understood that this is akin to storing ammonium nitrate in the open air.

This sounds interesting and twisted in some sense

1. A start up is validating a service provider to ensure that they are secure enough so that they can trust them before signing up for their service

2. The service provider is already trusted by so many big name companies who handed over their data, the customers data to them

Should it not be other way around?

On a different note, the finding is not just one off absolute, rather its a symptom which points to certain experience and expertise level for security practices. To be fair its hard to blame the start up folks, they are running against time and cutting corners is somewhat critical for survival for their business

Always check. I used a disk wiper , I checked the disk sectors, bang files under 1kb not really wiped...my "secrets" case..

It may make sense to change security practices so nothing has long term access. Everything should be rotated monthly, and maybe within a few years, hourly.

I'd call Docker out on this. Why the hell is it recording

A Markdown-as-a-Service where the interface is a Docker container.

I get how these choices might be the local optimum for a desired UX, but damn is it depressing to extrapolate where software as a whole is going.

Just signed up for strix, is it common for these type of products to want access to my Github repo's? Shouldn't the attack surface be outside them?