Github access token exposure

Summary

On January 26, @augustozanellato reported that while reviewing a public MacOS app, they found a valid GitHub Access Token belonging to a Shopify employee. This token had read and write access to Shopify-owned GitHub repositories. Upon validating the report, we immediately revoked the token and performed an audit of access logs to confirm no unauthorized activity had occurred.

I was reviewing an Electron app made by one of Shopify employees (at the time I didn't know that Shopify was in any way involved), after extracting the app.asar file using npx asar extract path/to/app.asar extracted/path I found a .env file, initially I skipped it because I thought it just contained some app configuration stuff but after taking a look at the source it was clear that the app never loaded it. It was probably a leftover of the release building process. That .env contained a GH_TOKEN variable, which is (as you can probably guess) a GitHub token, I tried using it to authenticate against GitHub REST API using curl -H "Authorization: token $GH_TOKEN" -H "Accept: application/vnd.github.v3+json" https://api.github.com/user, I saw that the token was indeed valid so I decided to hit the /user/orgs API endpoint and I got back (among others) the Shopify organization, then I hit the /orgs/Shopify/repos endpoint to confirm the GitHub token scope and I successfully got back a list containing both Shopify public and private repos with "permissions": {"admin": false, "push": true, "pull": true} so at that point I knew that the token was enabling me to perform arbitrary push and pulls to Shopify repos so potentially permitting me to place backdoors and such.