# Security: GitHub tokens exposed by apps deployed from GitHub **URL:** \ **Category:** General\ **Tags:** security\ **Created:** [November 12, 2026, 10:00pm UTC](https://community.fly.io/t/security-github-tokens-exposed-by-apps-deployed-from-github/29070 "2026-11-12T22:00:10Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![mjbraun](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/mjbraun/32/10247_2.png) [@mjbraun](https://community.fly.io/u/mjbraun)\ **Post date:** [November 12, 2026, 10:00pm UTC](https://community.fly.io/t/security-github-tokens-exposed-by-apps-deployed-from-github/29070/1 "2026-11-12T22:00:10Z")
On November 12, 2026 we learned that GitHub access tokens issued to the [Fly.io](http://Fly.io) GitHub App had been used by an unauthorized party to act on customer repositories. We took the [Fly.io](http://Fly.io) standard of 53 milliseconds of panic and then got to work. We initiated revocation of every user token issued to the app, notified the customers whose tokens were used, and changed how deploys from GitHub work. Now that the worst has passed here’s a bit about what happened and what folks should check. **To be clear: [Fly.io](http://Fly.io)’s systems were not breached. The tokens were read from files that the affected apps themselves were serving on the public internet.** When an app was deployed from a GitHub repository through the [Fly.io](http://Fly.io) dashboard or automatic deploys, the deploy process left a GitHub access token in the `.git/config` file of the build directory. Some apps include the whole build directory in their image and serve it over HTTP. For those apps the file, and the token in it, could be fetched from the app’s public URL. An unauthorized party collected tokens this way and used them as part of a wider campaign (known as “[wfx](https://www.ox.security/blog/thousands-of-github-accounts-hijacked-with-wfx-loot-ci-secret-stealing-malware-via-github-actions-npm/)”) against GitHub repositories. We have confirmed that tokens belonging to a small number of [Fly.io](http://Fly.io) accounts were used and we contacted those customers directly. Note that deploys with `flyctl`, [Fly.io](http://Fly.io) API tokens and running apps were not affected. ## About the tokens The stolen tokens were the tokens GitHub issues to the [Fly.io](http://Fly.io) GitHub App when you connect your GitHub account, and they grant access to any repository you can access AND where the [Fly.io](http://Fly.io) GitHub App is installed. The app’s permissions include write access to repository contents, GitHub Actions and pull requests. On the affected accounts the unauthorized party opened pull requests titled “docs: dependency audit notes” from a branch named `wfx-docs`, more than 250 in total, and created and deleted short-lived branches named `chore/` followed by 8 characters. Public reporting on the campaign describes those branches as carrying a script that runs in GitHub Actions, collects the secrets available to the workflow, and is then removed along with the workflow run. ## What we did - Initiated revocation of all user tokens issued to the [Fly.io](http://Fly.io) GitHub App, for every customer - Notified the small set of affected customers - Changed the deploy process and default ignore rules so that the token is no longer written into the build directory and that `.git` is not included in images built from GitHub ## What you should do **If you connected GitHub to [Fly.io](http://Fly.io):** 1. Since we’re revoking everyone’s GitHub token, you’ll need to sign in to [Fly.io](http://Fly.io) with GitHub again to reconnect. Automatic deploys for a repository resume once the person who originally connected it has done this. 2. Check the repositories the [Fly.io](http://Fly.io) GitHub App can access for activity since November 10 that you did not start: - pull requests titled “docs: dependency audit notes”, or a file named `docs/wfx-audit.md` - branches named `wfx-docs`, `chore/` followed by 8 characters, or `ci-check-` followed by 4 digits - commits with the messages “ci: refresh build cache”, “chore: add ci helper”, “chore: add dependency audit workflow”, “ci: restore” or “ci: cleanup” - workflow runs you did not start, including deleted runs in your GitHub security log 3. If you find any of these, treat the secrets available to GitHub Actions in that repository as stolen and rotate them. If your workflows use OIDC to reach a cloud provider, review that account for new access keys, changed role trust policies and new federated credentials. **If you deployed an app from GitHub through the dashboard:** 1. Request `https://.fly.dev/.git/config`. If it returns a git configuration file, your app is serving its `.git` directory. The token in that file is being revoked, but the directory also contains your repository’s source and history. Add `.git` to your `.dockerignore` and redeploy, and rotate any credentials that were ever committed to that repository. We contacted the customers whose tokens we know were used. If you did not hear from us, we have no evidence your token was used, but the checks above are still worth doing if step 4 applies to you. ## Thanks Thanks to Ashish Kurmi and the team at [StepSecurity](https://www.stepsecurity.io), who spotted the [Fly.io](http://Fly.io) GitHub App in the campaign’s activity and contacted us directly. ## Questions Reply here or hit us up at [security@fly.io](mailto:security@fly.io)