1-Click GitHub Token Stealing via a VSCode Bug(blog.ammaraskar.com)
620 points by ammar2 | 95 comments
A blog post describing a VSCode webview bug that lets an attacker steal a GitHub token with repo read/write access, including private repos, via a single click.