We got admin access to Baseten's production GitHub

Dockerfile secrets don’t vanish when the layer does. Strix pulled an image from a publicly readable Harbor registry and found a live GitHub PAT sitting in the build history metadata, because a RUN step expanded $GITHUB_TOKEN into the recorded command. It carried admin and push on the main product repo, the GitOps repo and the Homebrew tap, and had been valid since March 2023. Found in ~25 minutes of scanning; rotated a day after disclosure.