Okta says its GitHub account hacked, source code stolen
Red flags for me:<p>- Github alerted Okta about the access, they were not able to detect this themselves (<a href="https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization" rel="nofollow">https://docs.github.com/en/organizations/keeping-your-organi...</a>)<p>- It only says "access to code repositories" (it does not say anything about the level of that access, it might as well mean write access, capability to trigger actions etc.)<p>- Not relying on the confidentiality of source code is great, but malicious CD workflow actions would still be a risk if attackers had that level of access.<p>- No information about the entry point for compromise.<p>I doubt their 'commitment to transparency'.