Potential GitHub Credential Exposure Incident on April 2

On April 2, 2023, Replit discovered a security vulnerability that could expose GitHub authentication tokens for fewer than 0.01% of users using the GitHub import feature. This vulnerability may have allowed unauthorized read/write access to all repositories of the affected users.

However, to date, no evidence has been found that the exposed tokens were exploited or used to attack GitHub repositories.

The cause of the vulnerability was that the user-to-server token used when importing a GitHub repository into Replit was recorded in the git reflog. This could expose the token under the following conditions.

• The Repl is Public and has been forked by another user
• It is an HTML Repl or has an HTTP server configured, allowing the git reflog to be inspected externally

Replit immediately fixed the vulnerability and invalidated all related GitHub authentication tokens. Affected users were notified separately, and all users are required to re-authorize the GitHub integration for security.

Users should review their GitHub logs to check for any suspicious activity. If suspicious activity is found, it is recommended to immediately rotate any Secrets or credentials contained in the relevant repository.