{"action":"created","issue":{"url":"https://api.github.com/repos/ezsystems/ezplatform/issues/78","labels_url":"https://api.github.com/repos/ezsystems/ezplatform/issues/78/labels{/name}","comments_url":"https://api.github.com/repos/ezsystems/ezplatform/issues/78/comments","events_url":"https://api.github.com/repos/ezsystems/ezplatform/issues/78/events","html_url":"https://github.com/ezsystems/ezplatform/pull/78","id":125179053,"number":78,"title":"[Security][Travis] Update approach for github token to same as symfony uses","user":{"login":"andrerom","id":289757,"avatar_url":"https://avatars.githubusercontent.com/u/289757?v=3","gravatar_id":"","url":"https://api.github.com/users/andrerom","html_url":"https://github.com/andrerom","followers_url":"https://api.github.com/users/andrerom/followers","following_url":"https://api.github.com/users/andrerom/following{/other_user}","gists_url":"https://api.github.com/users/andrerom/gists{/gist_id}","starred_url":"https://api.github.com/users/andrerom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrerom/subscriptions","organizations_url":"https://api.github.com/users/andrerom/orgs","repos_url":"https://api.github.com/users/andrerom/repos","events_url":"https://api.github.com/users/andrerom/events{/privacy}","received_events_url":"https://api.github.com/users/andrerom/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-01-06T13:47:11Z","updated_at":"2016-01-08T08:10:25Z","closed_at":"2016-01-06T14:33:52Z","pull_request":{"url":"https://api.github.com/repos/ezsystems/ezplatform/pulls/78","html_url":"https://github.com/ezsystems/ezplatform/pull/78","diff_url":"https://github.com/ezsystems/ezplatform/pull/78.diff","patch_url":"https://github.com/ezsystems/ezplatform/pull/78.patch"},"body":"The [symfony approach](https://github.com/symfony/symfony/commit/6215437bdd6d6fc67ee167aea5e88324117be668) is more straight forward, and avoids setting a bad example for others *(risking they create tokens with a scope without being protected by githubs commit token scanners, unintentionally exposing rights to their repos)*.\r\n\r\nThis issue was reported by @ChALkeR as a possible security risk for us and especially downstream projects. *Note: The user connected to the token in question afaik never had membership rights on any of our repositories, however it had a scope enabled so if user by mistake would have had access to anything, then so would the token. The approach here is thus safer, as Gitub will automatically revoke any tokens they detect with scopes that pose a direct security risk.* "},"comment":{"url":"https://api.github.com/repos/ezsystems/ezplatform/issues/comments/169928077","html_url":"https://github.com/ezsystems/ezplatform/pull/78#issuecomment-169928077","issue_url":"https://api.github.com/repos/ezsystems/ezplatform/issues/78","id":169928077,"user":{"login":"crevillo","id":306215,"avatar_url":"https://avatars.githubusercontent.com/u/306215?v=3","gravatar_id":"","url":"https://api.github.com/users/crevillo","html_url":"https://github.com/crevillo","followers_url":"https://api.github.com/users/crevillo/followers","following_url":"https://api.github.com/users/crevillo/following{/other_user}","gists_url":"https://api.github.com/users/crevillo/gists{/gist_id}","starred_url":"https://api.github.com/users/crevillo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crevillo/subscriptions","organizations_url":"https://api.github.com/users/crevillo/orgs","repos_url":"https://api.github.com/users/crevillo/repos","events_url":"https://api.github.com/users/crevillo/events{/privacy}","received_events_url":"https://api.github.com/users/crevillo/received_events","type":"User","site_admin":false},"created_at":"2016-01-08T08:10:25Z","updated_at":"2016-01-08T08:10:25Z","body":"done on my side @andrerom https://github.com/crevillo/ezplatform-legacy/commit/bf80b0baa87e3bcdf7f0aa967e6ed2ce8ae8ffc1"}}