EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·27d ago·5 min read
We got admin access to Baseten's production GitHub in 25 minutes
TL;DR
Strix, an autonomous hacking agent, discovered a GitHub token with admin access to Baseten's internal repositories in just 25 minutes, raising serious security concerns.
✦ Why It Matters
Conduct security assessments on third-party services before integrating them into your workflow.
Key Takeaways
- Regularly scan your Docker images for sensitive information.
- Use secret management tools to avoid embedding credentials in images.
- Limit permissions for tokens used in builds to reduce impact of leaks.
- Conduct routine security assessments on third-party services before integration.
How It Works
Strix performs reconnaissance by mapping the surface of a target domain, identifying services, and analyzing Docker images for sensitive data. It inspects build histories to find credentials that may have been inadvertently included, leveraging tools like TruffleHog to detect secrets.