Hanwha

The reported camera flaw was not a subtle remote exploit: the login page itself exposed a GitHub administrative token. That turns a device setup page into a route toward a vendor’s software supply chain.

HN commenters broadened the lesson to hard-coded defaults, mobile apps, and embedded products where security review appears to arrive after shipping. One commenter said obfuscation once made this kind of inspection tedious; modern tooling makes it cheap.