A security camera page exposed a GitHub admin token in public (hhh.hn)
The reported camera flaw was not a subtle remote exploit: the login page itself exposed a GitHub administrative token. That turns a device setup page into a route toward a vendor’s software supply chain.
HN commenters broadened the lesson to hard-coded defaults, mobile apps, and embedded products where security review appears to arrive after shipping. One commenter said obfuscation once made this kind of inspection tedious; modern tooling makes it cheap.
Sign in to save