A GitHub PAT sat in a public container image's build history for three and a half years, with admin on the GitOps repo that controls Baseten's clusters

Strix·high signalXBlueskyLinkedInCopy link

Strix pulled the baseten/baseten-app image anonymously from a public Harbor registry, read the config blob's history[].created_by fields, and recovered a GITHUB_TOKEN that a March 3 2023 Docker build had passed as an ARG and expanded into a RUN line. The token was still live in July 2026 and carried admin and push on the main product repo, admin on the GitOps repo controlling their clusters, admin on the Homebrew tap, and read/write on customer private repos; Baseten rotated it within hours of the July 14 disclosure. Two concrete actions: switch build-time credentials to BuildKit secret mounts, and scan build history metadata rather than only filesystem layers, because the token never touched a layer.