Security Camera Shipped a GitHub Admin Token in Its Login Page HTML

What happened

A security researcher discovered that a Hanwha IP security camera shipped with a GitHub admin token hardcoded directly into the HTML source of its login page.

Context and impact

This finding illustrates persistent IoT and supply chain security issues. The compromised GitHub admin token could provide access to the company's entire repository, including source code for other products.

Details

• Token found in HTML of Hanwha IP camera login page
• Admin-level GitHub credential with access to company repositories
• Post scored 601 points on Hacker News (top story of the day)
• Illustrates secrets leakage risks in IoT firmware supply chains
• Similar issues previously documented at other IoT manufacturers
• Recommendation: credential rotation and firmware auditing before deployment