Shopify: Github access token exposure

While dissecting an application made by one of your employees I found his GitHub Personal Access Token PAT, he's a member of the org with pull and push access to all of your repositories. As a proof I can tell you that on the repo github.com/Shopify/shopify at commit hash cea9c273391d the sha512 ...

PT-2019-4005

Name of the Vulnerable Software and Affected Versions Harbor affected versions not specified Description The issue is related to a Broken Access Control vulnerability in the Harbor API. This vulnerability allows project administrators to create a robot account with unauthorized push and/or pull...