Niooss-Ledger

**Name of the Vulnerable Software and Affected Versions** Atlantis versions prior to 0.30.0 **Description** The issue concerns the exposure of GitHub credentials in Atlantis logs, specifically tokens starting with `ghs ...`, when they are rotated. This allows an attacker who can read these logs to impersonate the Atlantis application and perform actions on GitHub, potentially gaining administration privileges on a GitHub organization if Atlantis is used for administration. The problem was reported and fixed, with the fix included in Atlantis v0.30.0. **Recommendations** For versions prior to 0.30.0, upgrade to Atlantis v0.30.0 to resolve the issue. As a temporary workaround, consider restricting access to the Atlantis logs to minimize the risk of credential exposure. Additionally, review and limit the privileges assigned to the GitHub credentials used by Atlantis to reduce the potential impact of impersonation.