Comment by catidegla

The part that matters more than the public Harbor project: the image was built in March 2023 and the token still worked when they found it in July 2026. Over three years. That is a classic PAT with no expiry, which GitHub still lets you create and which is still the easiest thing to reach for when you are wiring up a bot account.

Secret scanning would not have caught it either. It reads repositories, not image layers sitting in a registry on your own subdomain, so the coverage stopped exactly where the leak was.