Employee's GitHub Token Found In Travis CI Build Logs

Summary

Our Security Team was notified by researchers who identified a valid leaked Github token in Travis CI logs that allow accessing a limited number of Grammarly repositories. We immediately revoked the token and conducted investigation together with the Github support team. Based on the available access log data, we have enough evidence to state that any other party did not use the token to access our repositories.

We want to thank @karimpwnz and @cdl for providing a detailed report, efficient communication, and further verification actions.

We would like to thank Grammarly for their cooperation and generous bounty.

This report was a part of our research on Travis CI's attack surface: https://edoverflow.com/2019/ci-knew-there-would-be-bugs-here/