---
title: How We Took Over a Flagship App Using Stolen GitHub Credentials
description: The number of connected devices is skyrocketing, with expectations of 22 billion by 2025. Managing these devices and their functions is no small task, and
---

[Blog ](https://ivision.com/blog)

# [How We Took Over a Flagship App Using Stolen GitHub Credentials](https://ivision.com/blog/-flagship-app-using-stolen-github-credentials)

 Written by [ivision](https://ivision.com/blog/author/ivision-1) | Jun 15, 2026 6:30:58 PM

 

Our Security Assessment team is constantly looking for creative ways to identify vulnerabilities. Geoff Robinson, Principal Consultant at ivision, shares how he gained unauthorized access by stealing a developer’s GitHub credentials.

Using those credentials, Geoff was able to inject a malicious action in to a GitHub runner host, which had access to the internal network. This granted him access to view all of the organization’s microservices. From there, Geoff exploited an authorization flaw in the Management API, and he was able to take control of the flagship application.

This goes to show that organizations must be sealed tight at every entry point. Reach out to ivision’s Security Assessment team today to gain full visibility of your environment and receive personalized recommendations to improve your security posture.

[View full post](https://ivision.com/blog/-flagship-app-using-stolen-github-credentials)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "ivision"
  },
  "dateModified" : "2026-06-15T18:30:58.893Z",
  "datePublished" : "2026-06-15T18:30:58Z",
  "headline" : "How We Took Over a Flagship App Using Stolen GitHub Credentials",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1024,
    "url" : "https://4024193.fs1.hubspotusercontent-na1.net/hubfs/4024193/AI-Generated%20Media/Images/Cybersecurity%20Team%20Analyzing%20Data%20in%20Futuristic%20Office.png",
    "width" : 1536
  },
  "mainEntityOfPage" : "https://ivision.com/blog/-flagship-app-using-stolen-github-credentials",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Blog"
  }
}
```