Skip to content

Comment on Mintlify GitHub read/write token leak

Comments

Mintlify sponsors one of my open source projects, express-rate-limit, and we use their service to host the docs for it. So I'm probably biased, but I've honestly been pretty happy with it overall - I'm thinking about using it for some of my other projects.

I think the best thing I can say about it is this: Mintlify helps us write better docs. Before Mintlify, we had a humongous readme plus a few one-off articles in the wiki. After switching the Mintlify, we started organizing things better, beginning with a less overwhelming readme.

I found out about this hack when they sent me an email yesterday. I looked through the git history (edit: and github activity), but nothing seems awry.

It sucks, but they're a pretty small business, and I think they're handling it reasonably well.

I looked through the git history, but nothing seems awry.

Git history or GitHub event history? You can easily push a malicious commit forged to have the same author and short hash.

Good point. I only looked through the git history initially, but I've now looked through both. Same conclusion.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.