Hacker News Reader

If a team member uses a personal token with Travis and the personal token can access private org repos, there’s a chance this can trigger.

View on HN

Absolutely. I hadn’t seen anything yet that was a smoking gun pointing at Travis. While it’s a likely candidate I wanted to voice that it might be another vector

Reply on news.ycombinator.com