A GitHub personal access token sat exposed in a Slack channel, posted in July 2024 and never rotated. That’s all it took to compromise an entire software build pipeline and gain the ability to poison every artifact the organisation shipped. It was a direct hit to the organisation’s software supply chain security.
This wasn’t a sophisticated zero-day. It was a credential sitting in plain sight, in a searchable workspace, for over a year. By the time we found it, hundreds of employees could have done the same.
The discovery
We started where we always do: with reconnaissance. While combing through historical Slack messages for exposed credentials, we found something that shouldn’t have been there.
A GitHub Personal Access Token (PAT). Posted publicly in a Slack thread. Dated July 2024.
We tested it. Still valid.
Which meant any employee, past or present, with access to that workspace could have reached into the organisation’s most critical systems using it. For over a year, this token had been an open door.
The approach
Armed with a valid PAT, we explored the organisation’s internal GitHub repositories. Our goal: escalate access without triggering alerts.
We identified a low-activity repository, something that wouldn’t draw attention if we started poking around. After cloning it locally, we created a branch using their standard naming conventions. Blend in. Move carefully. Stay invisible.
Then we reviewed the repository’s GitHub Actions workflow configuration.
That set up the next problem.
The exposure
GitHub Actions pipelines often handle sensitive credentials during builds, a common CI/CD security blind spot. In this case, the workflows exposed Artifactory credentials: the keys to the organisation’s internal artifact repository.
Here’s the catch: GitHub automatically masks secrets in logs, specifically to stop this kind of exfiltration.
So we built a new workflow: innocuous, low-profile. Then we started experimenting.
The breakthrough
After several iterations, we found the bypass.
Double-Base64 encoding.
By encoding the secret twice before it hit the logs, we sidestepped GitHub’s masking protections entirely. The credential passed through the pipeline and landed in our hands, intact.
We decoded it. Username. Password. Full Artifactory configuration. All in cleartext.
The supply chain security impact
With Artifactory credentials in hand, we had complete control over the organisation’s software supply chain:
- Download proprietary artifacts: Steal internal tools, libraries, and intellectual property
- Replace or poison artifacts: Inject malicious code into dependencies used across the organisation
- Compromise downstream systems: Any team pulling from Artifactory would be pulling our code
- Generate new API keys: Maintain persistent access even if the original credentials were rotated
A single exposed PAT escalated into full supply chain compromise.
But the real failure wasn’t technical. GitHub’s protections worked as designed. Artifactory’s credentials were properly scoped.
The failure was secrets management, not tooling:
- A credential posted in a public channel and never rotated
- No detection when a year-old token was actively used
- No monitoring for unusual GitHub Actions or artifact access patterns
- No enforcement of token expiration policies
One token. One year. One catastrophic supply chain risk.
What’s still sitting in your Slack history?
One overlooked token turned a build pipeline into a weapon for over a year. Most engineering teams have a credential like it right now: posted once, forgotten, never rotated.
Constant Cyber Attack™ finds tokens like this before they undermine your software supply chain security, then keeps checking. A one-time scan misses exactly what a stale credential needs to turn dangerous: time. Contact CovertSwarm.