AI-powered code documentation firm Mintlify says customer GitHub tokens were compromised in a data breach caused by a vulnerability in its systems, prompting it to launch a bug bounty program.
Mintlify helps developers generate code documentation.
It requires access to the source code, such as GitHub repositories, to analyze it, understand its purpose, and create descriptions.
In an incident notice on its website, the San Francisco-based company says that 91 customer tokens were exposed in a data breach identified on March 1, when it received a report of the issue and discovered unauthorized requests to its servers.
After learning that a customer's repository was accessed using GitHub tokens stored in its database, the company revoked all GitHub token access, rotated administrative access tokens, and hardened the security of its APIs.
Mintlify also says that it worked with a bug bounty reporter to address the underlying vulnerability, that it revoked all access tokens again on March 2, and that it is working with cybersecurity firms to investigate the incident and improve its security stance.
It's unclear if the individual who reported the vulnerability is the one who exploited the flaw.
Some 'bug bounty hunters' are known to use aggressive tactics, which include exploitation of a bug for what could be interpreted as malicious purposes, to ensure they receive a reward.
To make it easier for security researchers to report vulnerabilities, the company has launched a bug bounty program covering mintlify.com, dashboard.
Mintlify.com, and the Mintlify GitHub apps.
The reports should contain a description of the bug, steps to reproduce, details on the used environment, and proof-of-concept code if possible.
Previously unidentified vulnerabilities with a CVSS score of 4 or higher are guaranteed to receive financial compensation, the company says.
Additional information can be found on Mintlify's responsible disclosure page.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 19 Mar 2024 10:43:06 +0000