Comment Comment by sitkack Why does one person have admin on all those repos?Why is Python still running any classic access tokens?Why is the access token EVER in the source code?What other stuff is “running on their laptop”?No pass!People with access to the repos shouldn’t also have access to push bits to the world. It puts those people with that access in grave physical danger.Edit, https://blog.pypi.org/posts/2024-07-08-incident-report-leake...This token has been in the wild for 15 months! The JFrog post cannot say that disaster was averted because we do not know. parent sitkack 2 years ago
Why is Python still running any classic access tokens?
Why is the access token EVER in the source code?
What other stuff is “running on their laptop”?
No pass!
People with access to the repos shouldn’t also have access to push bits to the world. It puts those people with that access in grave physical danger.
Edit, https://blog.pypi.org/posts/2024-07-08-incident-report-leake...
This token has been in the wild for 15 months! The JFrog post cannot say that disaster was averted because we do not know.