What's this about?
Strix reported finding a still-active, high-privilege GitHub personal access token in a public Harbor Docker image's build-history metadata. It disclosed the July finding; Baseten removed/rotated the credential by the next day. The September HN thread resurfaced this resolved case, not a newly confirmed compromise.
What exactly is Docker image history?
A container image records its build steps. A secret passed into a command can linger in that metadata even when later files are cleaned; anyone able to pull the public image can inspect the old layer or history.
What's the community saying?
HN 234 points, 124 comments.
- The 25-minute automated discovery chain and quick remediation impressed readers.
- Readers debated authorisation and responsible disclosure when a third party scans a public service.
- Least-privilege tokens, secret-safe builds and old-image review matter more than compliance badges alone.