Baseten's Production GitHub Fell to a Leaked Token in 25 Minutes, Security Firm Says
Strix.ai says it obtained admin access to Baseten's production GitHub environment in about 25 minutes using an exposed credential, then disclosed the findings publicly.
A security company says it gained administrative control of Baseten's production GitHub environment in roughly 25 minutes, according to a writeup that topped Hacker News on Wednesday. Strix.ai published the account on its blog and pointed readers to a discussion thread that drew more than 200 upvotes and over 100 comments. Baseten, which sells infrastructure for running machine learning models, has not issued a public statement on the claim.
The Strix.ai post is titled around a personal access token, suggesting the entry point was a credential rather than a software exploit. The company says it moved from that initial find to full admin rights over the repository hosting Baseten's production code, a short hop that implies weak scoping or rotation on the token. Strix.ai did not say in the summary how the token was discovered or whether it belonged to a current employee, contractor, or automated system.
The timeline matters more than the technique. Twenty-five minutes is not a sophisticated intrusion; it is the window a single unrevoked secret can open when a repository's permission model is loose. GitHub personal access tokens can carry organization-wide scopes, and once one is valid, an attacker inherits whatever the issuing account could touch, including CI/CD workflows, deployment keys, and release pipelines that ship code to customers.
For an infrastructure vendor like Baseten, production repository access is not just a code problem. A company in that position holds customer model weights, API credentials, and deployment configurations inside its own systems, and a compromised pipeline can push altered artifacts downstream without anyone touching a server directly. The Hacker News thread's volume reflects how many engineers assume their own token hygiene is better than it is.
The disclosure raises the usual question about how the finding was handled before publication. Strix.ai's summary does not describe a coordinated disclosure window, a response from Baseten, or whether the access has since been revoked. Security researchers who test live production systems without authorization can face legal exposure even when they report what they find, which is why the sequence and timing of any notification will be scrutinized.
What to watch next is whether Baseten confirms the incident, revokes the credential in question, and says how long it was valid. GitHub's audit log would show which repositories the account accessed, what workflows were modified, and whether any secrets were read during the window. Until that record is public, the useful lesson for other teams is narrower but immediate: inventory long-lived tokens, scope them down, and rotate them on a schedule rather than after a headline.