Unit 42: open-source projects from Google, Microsoft, AWS, Red Hat, and others leaked GitHub auth tokens via GitHub Actions; GitHub chose not to fix the issues
Multiple high-profile open-source projects, including those from Google, Microsoft, AWS, and Red Hat, were found …
Context & Ripple Effects
This report places CI/CD credentials alongside an earlier GitHub incident in which stolen third-party OAuth tokens were used to access private repository data, including at npm: the Heroku and Travis-CI OAuth-token breach. The common exposure is not source visibility alone, but credentials that can carry repository access beyond their intended workflow.
It also extends a longer record of repository-security failures, from exposed repositories that leaked company source code to later maintainer responses such as Microsoft disabling dozens of compromised GitHub repositories.
First-order effects
- Affected open-source maintainers face an immediate credential-hygiene problem: tokens exposed through GitHub Actions workflows may need revocation, rotation, and workflow changes.
- GitHub's decision not to address the reported issues leaves the mitigation burden with projects using the affected Actions patterns rather than with a platform-level change.
Second-order effects
- Organizations that depend on these projects must treat upstream CI/CD configuration as part of their software-supply-chain risk, not merely the published code they consume.
- The finding increases pressure on CI tooling and project maintainers to constrain token permissions and reduce the lifetime and reach of workflow credentials.
Third-order effects
- If widely used automation platforms leave credential-leakage patterns to individual maintainers, open-source participation increasingly depends on each project's ability to operate production-grade security controls.
- The broader shift is toward treating build and automation credentials as a core boundary of shared software infrastructure, with platform defaults and governance becoming as consequential as code review.
The trend: This is one data point in the shift from repository security toward governed CI/CD identity and credential management across the open-source supply chain.