THE END OF GITHUB PATS

Summary from the TLDR InfoSec newsletter

Common GitHub workflows rely upon long-lived credentials such as PATs or GitHub apps to interact with repos. To eliminate the possibility of credentials leaking, Chainguard built an STS for GitHub which exchanges short-term credentials for short-term credentials. The architecture for the middleware is described in the post.