gg2
Admin access to Baseten's production GitHub
The gist
Strix found a live GitHub admin token for Baseten's repos in about 25 minutes.
The token had been exposed since March 2023, raising supply-chain risk for Baseten's customers.
How it unfolded
- Mar 2023A build step exposed a GitHub personal access token for basetenbot.
- Jul 2026Strix found the token, which had remained valid for more than three years.
- Sep 1, 2026Strix published its blog post 'We wanted to use Baseten for inference. We ended up with admin access to their GitHub'.