A pentest bot found Baseten's GitHub admin token in a public Docker image

Every Docker image carries its own build history in its config: the instruction that produced each layer, stored as plain text in a field called created_by. Anyone who can pull the image can read it. That is how a GitHub personal access token with admin rights on Baseten's production repositories sat in public view for more than three years, until an autonomous pentest agent read it in July.

Strix, the company that sells the agent, published the disclosure on its blog in September, and it reached the Hacker News front page on September 15 and 16 with about 320 points. Baseten is an AI inference platform that Erik van Klinken of Techzine puts at a $13 billion valuation. Strix says it ran the scan because its policy is to check a vendor before signing up, and it was evaluating Baseten as an inference provider at the time.

Twenty-five minutes, one image, one line

The agent enumerated Baseten's subdomains and found a Harbor container registry on a gcp-us-east4 hostname with one project set to public. It listed the repositories without credentials, obtained an anonymous pull token, and downloaded the baseten-app image. In the image config's history it found a RUN instruction from March 3, 2023 that expanded a build argument named GITHUB_TOKEN into the command line, which Docker recorded verbatim. The agent tested the token against the GitHub API. It was live. Strix says it carried admin and push rights on Baseten's main product repository and its GitOps deployment repository, plus read and write access to private repositories holding customer code. Strix co-founder Alex Schapiro puts the elapsed time at 25 minutes.

The check on your own images is one command. Build arguments used in a RUN line show up here; secrets mounted with BuildKit's secret mounts do not.

docker history --no-trunc your-image:tag | grep -iE 'token|secret|key|password'

Timeline, and what Baseten says

Strix reported the finding on July 13 at 11:10 PM. Baseten set the Harbor project to private the next morning, confirmed critical severity, and rotated the token by 4:34 PM on July 14. Techzine reports the remaining items closed by July 17. Baseten has not published a write-up of its own. In the Hacker News thread, a commenter identifying himself as Philip from Baseten's security team confirmed the timeline and wrote that "our logs confirm the vulnerability was never exploited and no customer data was exposed." Schapiro, posting in the same thread, called Baseten's response "super professional."

One point is contested. Another commenter argued that Strix crossed the white-hat line when it listed the contents of customer repositories to prove the token's scope, instead of stopping at the first successful authentication. Strix did not answer that directly in the thread. Techzine notes it relied on Strix's write-up and did not verify the technical details itself.

Why a build studio cares

A secret in image history survives every rotation policy, because the leaked copy is not in any inventory the policy reads. When we run the access and secrets pass in a Full Audit, we pull the client's images and read their history before we read their code, since a vendor's Dockerfile from 2023 is usually still the one shipping today. In our own builds a secret arrives through a BuildKit secret mount and never through ARG. The difference is one line. It is the line Baseten's 2023 build was missing.

Next step: read Strix's write-up, the Hacker News thread with Baseten's reply, and Techzine's report. If a vendor built your containers and nobody has run docker history on them, write to us at hello@gattyworks.com.