- Roll over effected passwords and API keys stored in private repos / containers
Quick take:
- Password hashes
- Github tokens
- Bitbucket tokens
- Your Automated Builds might need new tokens
Checking my github logs - It looks like they've known about this for at least a full 24 hours. Most people aren't going to have this looked at until Monday which kind of sucks. Hopefully there is more of a postmortem coming.
Is anyone from github able to comment on this as well?
There doesn't seem to be a way for us to tell if a repo was read by these keys over that time period.
- Change your password on https://hub.docker.com
- Check https://github.com/settings/security
- Reconnect oauth for Automated Builds
- Roll over effected passwords and API keys stored in private repos / containers
Quick take:
- Password hashes
- Github tokens
- Bitbucket tokens
- Your Automated Builds might need new tokens
Checking my github logs - It looks like they've known about this for at least a full 24 hours. Most people aren't going to have this looked at until Monday which kind of sucks. Hopefully there is more of a postmortem coming.
Is anyone from github able to comment on this as well?
There doesn't seem to be a way for us to tell if a repo was read by these keys over that time period.