告诉 HN：GitHub 可能泄露了你的 webhook 密钥。请查收邮件。
9 分•作者: ssiddharth•4 个月前
几分钟前收到了来自 Github 的邮件，要求我轮换我的 webhook 密钥，邮件的相关内容如下：
我们写信通知您，在 2025 年 9 月至 2026 年 1 月期间，您负责的 webhook 的 webhook 密钥被无意中包含在 webhook 传递的 HTTP 标头中。这意味着在此期间接收 webhook 负载的任何系统都可能从请求标头中记录了 webhook 密钥。Webhook 传递通过 TLS 在传输过程中进行加密，因此包含密钥的标头只能以 base64 编码的格式被接收端点访问。我们没有证据表明您的密钥被拦截。此问题已于 2026 年 1 月 26 日修复。请继续阅读以获取更多信息。
用户隐私和安全对于维护信任至关重要，我们希望尽可能透明地公开此类事件。GitHub 本身并未因此事件而遭受任何入侵或数据泄露。
发生了什么？
2026 年 1 月 26 日，GitHub 在新版本的 webhook 传递平台中发现了一个错误，该错误导致 webhook 密钥被包含在随 webhook 负载一起发送的 `X-Github-Encoded-Secret` HTTP 标头中。此标头不应作为传递的一部分，并且使 webhook 密钥可以以 base64 编码的格式提供给接收端点。Webhook 密钥用于验证传递是否确实来自 GitHub，并且应该仅为 GitHub 和 webhook 所有者所知。
该错误仅限于使用此新版本 webhook 平台的 webhook 传递的子集。该错误存在于 2025 年 9 月 11 日至 2025 年 12 月 10 日之间，并在 2026 年 1 月 5 日短暂出现。该错误已于 2026 年 1 月 26 日修复。
涉及了什么信息？
在存在该错误的期间，每个受影响的 webhook 的 webhook 密钥都包含在 HTTP 请求标头中。Webhook 负载内容本身被正常传递，并且没有受到额外影响。没有其他凭据或令牌受到影响。Webhook 传递通过 TLS 在传输过程中进行加密，因此包含密钥的标头只能被接收端点访问。
如果接收系统记录了 HTTP 请求标头，则 webhook 密钥可能存在于这些日志中。Webhook 密钥用于计算传递的 `X-Hub-Signature-256` HMAC 签名——如果被泄露，知道密钥的攻击者可以伪造 webhook 负载，使其看起来像是来自 GitHub。
查看原文
Got an email from Github a few minutes back asking me to rotate my webhook secrets, the relevant portions of it below.<p><i>We're writing to let you know that between September 2025 and January 2026, webhook secrets for webhooks you are responsible for were inadvertently included in an HTTP header on webhook deliveries. This means that any system receiving webhook payloads during this window could have logged the webhook secret from the request headers. Webhook deliveries are encrypted in transit via TLS, so the header containing the secret was only accessible to the receiving endpoint in a base64-encoded format. We have no evidence to suggest your secrets were intercepted. This issue was fixed on January 26, 2026. Please read on for more information.</i><p><i>User privacy and security are essential for maintaining trust, and we want to remain as transparent as possible about events like these. GitHub itself did not experience a compromise or data breach as a result of this event.</i><p><i>What happened?</i><p><i>On January 26, 2026, GitHub identified a bug in a new version of the webhook delivery platform where webhook secrets were included in an `X-Github-Encoded-Secret` HTTP header sent with webhook payloads. This header was not intended to be part of the delivery and made the webhook secret available to the receiving endpoint in a base64-encoded format. Webhook secrets are used to verify that deliveries are genuinely from GitHub, and should only be known to GitHub and the webhook owner.</i><p><i>The bug was limited to only a subset of webhook deliveries that were feature flagged to use this new version of the webhooks platform. The bug was present between September 11, 2025, and December 10, 2025, and briefly on January 5, 2026. The bug was fixed on January 26, 2026.</i><p><i>What information was involved?</i><p><i>The webhook secret for each affected webhook was included in HTTP request headers during the window that the bug was present. The webhook payload content itself was delivered normally and was not additionally affected. No other credentials or tokens were affected. Webhook deliveries are encrypted in transit via TLS, so the header containing the secret was only accessible to the receiving endpoint.</i><p><i>If the receiving system logged HTTP request headers, the webhook secret may be present in those logs. The webhook secret is used to compute the `X-Hub-Signature-256` HMAC signature on deliveries — if compromised, an attacker who knows the secret could forge webhook payloads to make them appear to come from GitHub.</i>