GitHub 在 webhook 调用中泄露了 webhook 密钥。
无法在网页上查看此内容...<p>来自一封电子邮件：<p>我们写信通知您，在2025年9月至2026年1月期间，您负责的webhook的密钥不小心包含在webhook交付的HTTP头中。这意味着在此期间接收webhook有效负载的任何系统都可能从请求头中记录了webhook密钥。webhook交付在传输过程中通过TLS加密，因此包含密钥的头部仅以base64编码格式对接收端点可访问。我们没有证据表明您的密钥被拦截。此问题已于2026年1月26日修复。请继续阅读以获取更多信息。<p>用户隐私和安全对于维护信任至关重要，我们希望尽可能透明地处理此类事件。GitHub本身并未因这一事件而遭受损害或数据泄露。<p>* 发生了什么？ *<p>在2026年1月26日，GitHub发现了webhook交付平台新版本中的一个错误，该错误导致webhook密钥包含在随webhook有效负载发送的X-Github-Encoded-Secret HTTP头中。该头部并不应成为交付的一部分，因此使得webhook密钥以base64编码格式可供接收端点访问。webhook密钥用于验证交付确实来自GitHub，且应仅为GitHub和webhook所有者所知。<p>该错误仅限于使用此新版本webhook平台的部分webhook交付。该错误在2025年9月11日至2025年12月10日之间存在，并在2026年1月5日短暂出现。该错误已于2026年1月26日修复。
查看原文
Couldn't see this on a Web page...<p>From an email:<p>We're writing to let you know that between September 2025 and January 2026, webhook secrets for webhooks you are responsible for were inadvertently included in an HTTP header on webhook deliveries. This means that any system receiving webhook payloads during this window could have logged the webhook secret from the request headers. Webhook deliveries are encrypted in transit via TLS, so the header containing the secret was only accessible to the receiving endpoint in a base64-encoded format. We have no evidence to suggest your secrets were intercepted. This issue was fixed on January 26, 2026. Please read on for more information.<p>User privacy and security are essential for maintaining trust, and we want to remain as transparent as possible about events like these. GitHub itself did not experience a compromise or data breach as a result of this event.<p>* What happened? *<p>On January 26, 2026, GitHub identified a bug in a new version of the webhook delivery platform where webhook secrets were included in an X-Github-Encoded-Secret HTTP header sent with webhook payloads. This header was not intended to be part of the delivery and made the webhook secret available to the receiving endpoint in a base64-encoded format. Webhook secrets are used to verify that deliveries are genuinely from GitHub, and should only be known to GitHub and the webhook owner.<p>The bug was limited to only a subset of webhook deliveries that were feature flagged to use this new version of the webhooks platform. The bug was present between September 11, 2025, and December 10, 2025, and briefly on January 5, 2026. The bug was fixed on January 26, 2026