Title: A number of Travis CI users appear to have had Travis CI tokens revoked by Github in response to suspicious activity surrounding token.<p>Travis themselves have still not issued any notice or acknowledged this incident so it&#x27;s worth letting the community know if they weren&#x27;t already aware.<p>From memory, this will be the second breach in 2022 (<a href="https:&#x2F;&#x2F;blog.aquasec.com&#x2F;travis-ci-security" rel="nofollow">https:&#x2F;&#x2F;blog.aquasec.com&#x2F;travis-ci-security</a>) in addition to last year&#x27;s secret exposure (<a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2021&#x2F;09&#x2F;travis-ci-flaw-exposed-secrets-for-thousands-of-open-source-projects&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2021&#x2F;09&#x2F;travi...</a>)<p>---<p>A sampling of users on Twitter who have run into this issue:<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;peter_szilagyi&#x2F;status&#x2F;1600593274108055559" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;peter_szilagyi&#x2F;status&#x2F;160059327410805555...</a><p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;yaqwsx_cz&#x2F;status&#x2F;1600599797118996491" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;yaqwsx_cz&#x2F;status&#x2F;1600599797118996491</a><p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;samonchain&#x2F;status&#x2F;1600611567606775808" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;samonchain&#x2F;status&#x2F;1600611567606775808</a><p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;dzarda_cz&#x2F;status&#x2F;1600613369408634886" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;dzarda_cz&#x2F;status&#x2F;1600613369408634886</a><p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;samonchain&#x2F;status&#x2F;1600611567606775808" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;samonchain&#x2F;status&#x2F;1600611567606775808</a><p>---<p>An example notice being sent out by Github (in lieu of Travis themselves taking any action):<p>&gt; Hi {username}<p>&gt; We&#x27;re writing to let you know that we observed suspicious activity that suggests a threat actor used a Personal Access Token (PAT) associated with your account to access private repository metadata.<p>&gt; Out of an abundance of caution, we reset your account password and revoked all of your Personal Access Tokens (classic), OAuth App tokens, and GitHub App tokens to protect your account, {username}.
Upvote: