A small but unspecified number of GitHub staff could have seen plaintext passwords. GitHub has said a bug exposed some user passwords — in plaintext.
The code repository site, with more than 27 million users as of last year, sent an email to affected users Tuesday.
“During the course of regular auditing, GitHub discovered that a recently introduced bug exposed a small number of users’ passwords to our internal logging system,” said the email, received by some users.
The email said that a handful of GitHub staff could have seen those passwords — and that it’s “unlikely” that any GitHub staff accessed the site’s internal logs.
“We have corrected this, but you’ll need to reset your password to regain access to your account,” the email added.
ZDNet reached out to several users who received the email and verified its authenticity.
It’s not known how many users received the email. We’ve reached out to GitHub prior to publication with questions but did not immediately hear back. If that changes, we’ll update.
It’s unclear exactly how this bug occurred. GitHub’s explanation was that it stores user passwords with bcrypt, a stronger password hashing algorithm, but that the bug “resulted in our secure internal logs recording plaintext user passwords when users initiated a password reset.”
“Rest assured, these passwords were not accessible to the public or other GitHub users at any time,” the email said.
GitHub said it “has not been hacked or compromised in any way.”
In 2016, the company reset some user passwords after it found some accounts had fallen victim to a password reuse attack, where credentials used on other sites are leaked and used to access accounts on other sites.
