# A HackerOne employee's GitHub personal access token exposed in Travis CI build logs

A HackerOne employee's GitHub personal access token leaked into public Travis CI build logs, granting push/admin access to all public repos the account could reach.

- Payout: $2,000
- Severity: medium
- Program: HackerOne
- Credited: sainaen
- Disclosed: 2017-05-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/215625
- Library page: https://bugbountylibrary.com/r/h1%3A215625
- Tags: domain:oss impact:integrity impact:internal-access kind:bounty platform:hackerone sev:medium tech:github-actions technique:recon vuln:info-disclosure vuln:secrets-leak

**Target:** GitHub personal access token in Travis CI build logs
**Root cause:** A `git push -q` in a CI script suppressed output except on error; a missing `--force` caused a push error, which printed the remote URL containing the embedded token into public build logs.
**Steps:**
1. Scan public CI build logs (Travis) for secrets, e.g. tokens in git remote URLs
2. Find `https://<token>@github.com/...` echoed in error output at job log lines
3. Note token scope via GitHub API (`public_repo`)
4. Confirm token grants push/admin to public repos of the owner's orgs
**How found:** Researcher monitored public CI build logs for exposed credentials; noticed the token appeared twice in error output of a `git push` step, then reasoned the `-q` flag only suppresses output unless an error occurs.
**Exploitation:** Attacker with the leaked token could push commits to any public repo the owner had access to (including Hacker0x01 org repos), with author/committer spoofable to any identity; no UI reveals which account pushed.
**Escalation:** Token scope `public_repo` plus owner's admin rights on Hacker0x01 public repos widened impact from a single repo to the whole org's public code.
**Insight:** CI logs are a high-yield secret-hunting surface: `git push -q` still dumps the remote URL (with embedded token) on failure, so grep build logs for `@github.com`/`@gitlab.com` credential patterns and check token scopes via API.