Heroku Held the Keys: Anatomy of a Vendor-Token Breach
GitHub's OAuth tokens lived in Heroku's infrastructure. One compromised CI cache later, an ecosystem learned where vendor tokens really live.
GitHub’s OAuth supply chain: the Heroku Token Heist That Reached npm
Attackers stole GitHub integration tokens from Heroku and Travis CI, pivoted into npm, and downloaded ~109,000 publishing credentials.