Analytics service Waydev says hackers breached it earlier this month and stole GitHub, GitLab OAuth tokens, likely pivoting to attack other companies like Dave
Context & Ripple Effects
Waydev's disclosure is an early entry in what has since become a repeating playbook: attackers compromise a third party holding OAuth tokens into GitHub and GitLab, then ride those credentials into victims' repositories. The company says hackers stole GitHub and GitLab OAuth tokens earlier in July, and the relationship notes flag fintech Dave as a likely pivot target.
The same pattern resurfaced at scale two years later, when GitHub confirmed an attacker used stolen OAuth user tokens issued to Heroku and Travis-CI to download private repository data from npm and dozens of other organizations. In between, Dropbox traced code and API-key theft across 130 GitHub repositories to a phishing campaign ([[a:984451]]) and Okta reported its own GitHub source code stolen ([[a:986045]]) — each incident reinforcing that developer-platform access held by vendors is now a primary attack surface.
First-order effects
- Companies using Waydev's analytics service — including Dave, explicitly named as a likely pivot target — must assume their GitHub and GitLab-connected repositories were exposed and rotate every OAuth grant issued through Waydev.
- GitHub and GitLab face immediate pressure to audit, revoke, and re-issue tokens tied to the breached analytics vendor before stolen credentials can be replayed against downstream customers.
Second-order effects
- Every DevOps analytics and CI vendor holding GitHub/GitLab tokens inherits the trust deficit: customers start demanding token scoping, expiry, and revocation controls as procurement conditions, raising integration costs across the category.
- GitHub's eventual response template — publicly confirming token abuse, naming the issuing apps, and forcing revocations, as it did in the Heroku and Travis-CI token theft — becomes the expected playbook, pushing platform providers toward tighter vetting of which third-party apps get OAuth issuance rights.
Third-order effects
- If the pattern holds, software supply-chain security shifts from defending endpoints to governing delegated credentials: the OAuth ecosystem around major developer platforms gets treated like a supply chain, with issuers audited and least-privilege defaults enforced platform-wide.
- Vendors whose product is deep read access to customer source control face structural repricing — their value depends on broad token scope, but that same scope makes them the weakest link customers must pay to contain, favoring tools designed for narrow, revocable access.
The trend: Developer-platform breaches are consolidating around stolen OAuth tokens held by trusted third-party vendors, turning the GitHub/GitLab app ecosystem itself into the contested supply chain.