A GitHub PAT sat in a public container image's build history for three and a half years.

Strix pulled baseten/baseten-app anonymously from a public Harbor registry and read the token out of the config blob's history[].created_by fields, where a March 2023 Docker build had passed it as an ARG that expanded into a RUN line. Still live in July 2026, carrying admin and push on the main product repo, admin on the GitOps repo controlling their clusters, admin on the Homebrew tap, and read/write on customer private repos. Baseten rotated within hours of the July 14 disclosure. The token never touched a filesystem layer, so layer scanning missed it entirely. Two fixes: BuildKit secret mounts for build-time credentials, and scan build history metadata, not just layers.