Re: [Csnd-dev] [EXTERNAL] [Csnd-dev] FYI: Security Issue on Github with my account

--000000000000a32b7b06561a43ef
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Although I think I've addressed the root cause, performing some security
auditing probably wouldn't be a bad idea.

On Wed, Jul 8, 2026 at 4:22=E2=80=AFAM Victor Lazzarini <
[email protected]> wrote:

> Should we tighten up security in all repos in the project?
>
> Prof. Victor Lazzarini
> Maynooth University
> Ireland
>
> > On 8 Jul 2026, at 01:57, Steven Yi <[email protected]> wrote:
> >
> > =EF=BB=BF
> > Hi All,
> >
> > FYI: I found that a series of commits made to the web-ide project
> yesterday were attributed to my account, but I did not author them. They
> were clearly malicious, attempting to read secrets from the project. I
> revoked access tokens and ssh keys, and then force-pushed to remove the
> offending commits. Branch protection rules are now in place for web-ide.
> >
> > I'm unsure if the breach involved an old access token, an SSH key, or
> was just a commit spoof. I think I've taken the necessary steps to preven=
t
> further issues, but if you see any strange commits attributed to my
> account, please let me know.
> >
> > Thanks,
> > Steven
> The information contained in this email may be confidential and
> privileged. It is intended only for the addressee(s) stated above. If you
> are not an addressee any use, dissemination, distribution, publication or
> copying of the information contained in this email is strictly prohibited=
.
> If you have received this email in error, please immediately notify us by
> email at [email protected]<mailto:[email protected]> and delete
> this email from your system.
>
> Please note that Maynooth University is subject to Freedom of Information
> and Data Protection laws. We may be required to disclose the content of
> emails under the FOI Act 2014, the Data Protection Act 2018 or GDPR.
>
> Is don seola=C3=AD / do na seolaithe thuasluaite amh=C3=A1in an r=C3=ADom=
hphost seo.
> D=E2=80=99fh=C3=A9adfadh an t-eolas at=C3=A1 ann a bheith r=C3=BAnda agus=
 faoi phribhl=C3=A9id. Mura
> seola=C3=AD t=C3=BA, t=C3=A1 cosc ioml=C3=A1n ar aon eolas at=C3=A1 sa r=
=C3=ADomhphost seo a =C3=BAs=C3=A1id, a
> scaipeadh, a dh=C3=A1ileadh, a fhoilsi=C3=BA n=C3=B3 a ch=C3=B3ipe=C3=A1i=
l. M=C3=A1 fuair t=C3=BA an
> r=C3=ADomhphost seo tr=C3=AD thimpiste, cuir sin in i=C3=BAl d=C3=BAinn l=
=C3=A1ithreach tr=C3=AD
> r=C3=ADomhphost a chur chuig  [email protected]<mailto:dataprotection@=
mu.ie>
> agus scrios an r=C3=ADomhphost seo =C3=B3 do ch=C3=B3ras.
>
> Tabhair faoi deara go bhfuil Ollscoil Mh=C3=A1 Nuad faoi r=C3=A9ir dhl=C3=
=ADthe um
> Shaor=C3=A1il Faisn=C3=A9ise agus um Chosaint Sonra=C3=AD. D=E2=80=99fh=
=C3=A9adfadh ceangal a bheith
> orainn =C3=A1bhar r=C3=ADomhphoist a nochtadh faoin Acht um Shaor=C3=A1il=
 Faisn=C3=A9ise 2014,
> faoin Acht um Chosaint Sonra=C3=AD 2018 n=C3=B3 faoi GDPR.
>
> Registered charity number 20037130
>
>
>

--000000000000a32b7b06561a43ef
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Although I think I&#39;ve addressed the root cause, perfor=
ming some security auditing probably wouldn&#39;t be a bad idea.=C2=A0</div=
><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" clas=
s=3D"gmail_attr">On Wed, Jul 8, 2026 at 4:22=E2=80=AFAM Victor Lazzarini &l=
t;<a href=3D"mailto:[email protected]">0000=
[email protected]</a>&gt; wrote:<br></div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex">Should we tighten up security =
in all repos in the project?<br>
<br>
Prof. Victor Lazzarini<br>
Maynooth University<br>
Ireland<br>
<br>
&gt; On 8 Jul 2026, at 01:57, Steven Yi &lt;<a href=3D"mailto:stevenyi@gmai=
l.com" target=3D"_blank">[email protected]</a>&gt; wrote:<br>
&gt;<br>
&gt; =EF=BB=BF<br>
&gt; Hi All,<br>
&gt;<br>
&gt; FYI: I found that a series of commits made to the web-ide project yest=
erday were attributed to my account, but I did not author them. They were c=
learly malicious, attempting to read secrets from the project. I revoked ac=
cess tokens and ssh keys, and then force-pushed to remove the offending com=
mits. Branch protection rules are now in place for web-ide.<br>
&gt;<br>
&gt; I&#39;m unsure if the breach involved an old access token, an SSH key,=
 or was just a commit spoof. I think I&#39;ve taken the necessary steps to =
prevent further issues, but if you see any strange commits attributed to my=
 account, please let me know.<br>
&gt;<br>
&gt; Thanks,<br>
&gt; Steven<br>
The information contained in this email may be confidential and privileged.=
 It is intended only for the addressee(s) stated above. If you are not an a=
ddressee any use, dissemination, distribution, publication or copying of th=
e information contained in this email is strictly prohibited. If you have r=
eceived this email in error, please immediately notify us by email at <a hr=
ef=3D"mailto:[email protected]" target=3D"_blank">[email protected]</=
a>&lt;mailto:<a href=3D"mailto:[email protected]" target=3D"_blank">data=
[email protected]</a>&gt; and delete this email from your system.<br>
<br>
Please note that Maynooth University is subject to Freedom of Information a=
nd Data Protection laws. We may be required to disclose the content of emai=
ls under the FOI Act 2014, the Data Protection Act 2018 or GDPR.<br>
<br>
Is don seola=C3=AD / do na seolaithe thuasluaite amh=C3=A1in an r=C3=ADomhp=
host seo. D=E2=80=99fh=C3=A9adfadh an t-eolas at=C3=A1 ann a bheith r=C3=BA=
nda agus faoi phribhl=C3=A9id. Mura seola=C3=AD t=C3=BA, t=C3=A1 cosc ioml=
=C3=A1n ar aon eolas at=C3=A1 sa r=C3=ADomhphost seo a =C3=BAs=C3=A1id, a s=
caipeadh, a dh=C3=A1ileadh, a fhoilsi=C3=BA n=C3=B3 a ch=C3=B3ipe=C3=A1il. =
M=C3=A1 fuair t=C3=BA an r=C3=ADomhphost seo tr=C3=AD thimpiste, cuir sin i=
n i=C3=BAl d=C3=BAinn l=C3=A1ithreach tr=C3=AD r=C3=ADomhphost a chur chuig=
=C2=A0 <a href=3D"mailto:[email protected]" target=3D"_blank">dataprotec=
[email protected]</a>&lt;mailto:<a href=3D"mailto:[email protected]" target=3D"=
_blank">[email protected]</a>&gt;=C2=A0 agus scrios an r=C3=ADomhphost s=
eo =C3=B3 do ch=C3=B3ras.<br>
<br>
Tabhair faoi deara go bhfuil Ollscoil Mh=C3=A1 Nuad faoi r=C3=A9ir dhl=C3=
=ADthe um Shaor=C3=A1il Faisn=C3=A9ise agus um Chosaint Sonra=C3=AD. D=E2=
=80=99fh=C3=A9adfadh ceangal a bheith orainn =C3=A1bhar r=C3=ADomhphoist a =
nochtadh faoin Acht um Shaor=C3=A1il Faisn=C3=A9ise 2014, faoin Acht um Cho=
saint Sonra=C3=AD 2018 n=C3=B3 faoi GDPR.<br>
<br>
Registered charity number 20037130<br>
<br>
<br>
</blockquote></div>

--000000000000a32b7b06561a43ef--