On April 15, WorkOS was notified by Heroku/Salesforce of a security incident (https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens) that affects all Heroku GitHub integrations. WorkOS uses Heroku for our platform application servers and makes use of the GitHub integration.
On April 12, GitHub uncovered evidence that an attacker abused stolen OAuth user tokens issued to Heroku. This means the attacker may have accessed private repositories.
WorkOS has implemented recommendations from Heroku (https://status.heroku.com/incidents/2413) and revoked Heroku OAuth tokens from GitHub as a precaution. We’ve also analyzed our GitHub audit logs and have not detected any suspicious activity.
At this time there is no evidence that WorkOS was affected by this security incident. We’re continuing to monitor updates from Heroku and GitHub and taking action as necessary.
