GitBook Restores Services After Attacker Accessed Some Infrastructure Credentials

·3 views

GitBook says it was the target of a targeted attack that gained unauthorized access to some of its infrastructure credentials on November 2 at 19:00 CET. The company detected the intrusion quickly, blocked the attacker, and took its app and authenticated docs sites offline as a precaution while published content stayed live via cached data. It has since replaced all credentials and secrets, invalidated customers' API tokens, and restored services now that it is confident they are secure. According to its investigation, the attacker may have accessed Git Sync secrets, GitBook API tokens, third-party API tokens, and questions asked to GitBook Assistant, though no evidence was found that customer content was modified. Customers are advised to rotate API tokens and integration secrets and re-authenticate the MCP server, with a full post-mortem promised.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Building Automation and AI Workflows That Recover Gracefully From Failures

Automation workflows often perform well in testing but break when real-world conditions introduce timeouts, malformed AI outputs, or missing webhook fields. The article argues that developers should plan for errors rather than only the ideal path. It recommends validating incoming data before it reaches costly AI prompts or database writes, so bad inputs are caught early. It also advises configuring explicit error branches with fallback paths, retries, and notifications for high-risk steps like API calls. For AI nodes, it suggests using structured output features and feeding parsing errors back to the model for correction. Finally, it recommends centralized logging of failures to make troubleshooting faster.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Securing Telegram Mini Apps: Server-Side HMAC Validation to Stop Identity Spoofing in PHP

Many Telegram Mini Apps read user IDs from the client-side initDataUnsafe object and trust them on the backend, which lets attackers change the ID in browser memory and act as other users. The article explains that the backend should instead verify the raw initData query string, which Telegram signs with a hash. Verification uses a two-step HMAC-SHA256 process: deriving a secret key from the bot token with the constant "WebAppData", then hashing the alphabetically sorted key-value pairs. The author warns that PHP's parse_str() alters key order and decoding, causing hash mismatches, so manual parsing is recommended. The piece also provides a standalone PHP validation function and advises checking auth_date for expiration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI CodeOps Adds AI Code Review Support for Gitea and Forgejo

Most AI code review tools launch with GitHub support before extending to GitLab and Bitbucket, leaving teams on Gitea or Forgejo with few options. The article notes that CodeRabbit's documentation lists GitHub, GitLab, Bitbucket and Azure DevOps but no Gitea or Forgejo support as of November 2026. AI CodeOps is presented as a tool that works with both platforms, including self-hosted servers, by connecting via a repository-scoped token. Its features include severity-sorted AI review of real diffs, test runs in a sandbox, and a release gate requiring passing tests and human approval before merging. The tool is free during its open beta and free permanently for non-commercial open-source projects.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Awake: Open-Source macOS App Keeps MacBooks Running With Lid Closed

A developer has released Awake, a free open-source macOS 26 utility that keeps a MacBook running with its lid closed, preventing background tasks like SSH sessions, Docker builds, and AI coding agents from stopping. It works by combining the pmset disablesleep setting with caffeinate and live monitoring of the lid state, and it locks the screen automatically whenever the lid closes. A battery safety feature re-enables normal sleep if battery temperature reaches 40°C or charge falls to 10% or lower, then resumes once conditions improve. Users can control it from Control Center, the menu bar with countdown timers, or a command-line tool, and it is distributed under the MIT license via GitHub and Homebrew.

0 comments Read more at DEV Community