On November 12, 2026 we learned that GitHub access tokens issued to the Fly.io GitHub App had been used by an unauthorized party to act on customer repositories. We took the Fly.io standard of 53 milliseconds of panic and then got to work. We initiated revocation of every user token issued to the app, notified the customers whose tokens were used, and changed how deploys from GitHub work. Now that the worst has passed here’s a bit about what happened and what folks should check.
To be clear: Fly.io’s systems were not breached. The tokens were read from files that the affected apps themselves were serving on the public internet.
When an app was deployed from a GitHub repository through the Fly.io dashboard or automatic deploys, the deploy process left a GitHub access token in the .git/config file of the build directory. Some apps include the whole build directory in their image and serve it over HTTP. For those apps the file, and the token in it, could be fetched from the app’s public URL. An unauthorized party collected tokens this way and used them as part of a wider campaign (known as “wfx”) against GitHub repositories.
We have confirmed that tokens belonging to a small number of Fly.io accounts were used and we contacted those customers directly. Note that deploys with flyctl, Fly.io API tokens and running apps were not affected.
About the tokens
The stolen tokens were the tokens GitHub issues to the Fly.io GitHub App when you connect your GitHub account, and they grant access to any repository you can access AND where the Fly.io GitHub App is installed. The app’s permissions include write access to repository contents, GitHub Actions and pull requests.
On the affected accounts the unauthorized party opened pull requests titled “docs: dependency audit notes” from a branch named wfx-docs, more than 250 in total, and created and deleted short-lived branches named chore/ followed by 8 characters. Public reporting on the campaign describes those branches as carrying a script that runs in GitHub Actions, collects the secrets available to the workflow, and is then removed along with the workflow run.
What we did
- Initiated revocation of all user tokens issued to the Fly.io GitHub App, for every customer
- Notified the small set of affected customers
- Changed the deploy process and default ignore rules so that the token is no longer written into the build directory and that
.gitis not included in images built from GitHub
What you should do
If you connected GitHub to Fly.io:
- Since we’re revoking everyone’s GitHub token, you’ll need to sign in to Fly.io with GitHub again to reconnect. Automatic deploys for a repository resume once the person who originally connected it has done this.
- Check the repositories the Fly.io GitHub App can access for activity since November 10 that you did not start:
- pull requests titled “docs: dependency audit notes”, or a file named
docs/wfx-audit.md - branches named
wfx-docs,chore/followed by 8 characters, orci-check-followed by 4 digits - commits with the messages “ci: refresh build cache”, “chore: add ci helper”, “chore: add dependency audit workflow”, “ci: restore” or “ci: cleanup”
- workflow runs you did not start, including deleted runs in your GitHub security log
- pull requests titled “docs: dependency audit notes”, or a file named
- If you find any of these, treat the secrets available to GitHub Actions in that repository as stolen and rotate them. If your workflows use OIDC to reach a cloud provider, review that account for new access keys, changed role trust policies and new federated credentials.
If you deployed an app from GitHub through the dashboard:
- Request
https://<your-app>.fly.dev/.git/config. If it returns a git configuration file, your app is serving its.gitdirectory. The token in that file is being revoked, but the directory also contains your repository’s source and history. Add.gitto your.dockerignoreand redeploy, and rotate any credentials that were ever committed to that repository.
We contacted the customers whose tokens we know were used. If you did not hear from us, we have no evidence your token was used, but the checks above are still worth doing if step 4 applies to you.
Thanks
Thanks to Ashish Kurmi and the team at StepSecurity, who spotted the Fly.io GitHub App in the campaign’s activity and contacted us directly.
Questions
Reply here or hit us up at security@fly.io