GitHub Admin Token Leaked via Security Camera: The Hanwha Incident

A connected surveillance camera, meant to protect a building, ends up exposing a critical secret of its own. That is exactly what a security researcher discovered in late July 2026 on equipment from Korean manufacturer Hanwha Vision. A GitHub admin token had been hardcoded into the source code of the camera’s web interface, accessible to anyone inspecting the login page. Here is a look back at an incident that shows just how much secrets management remains the Achilles’ heel of industrial IoT.

Hanwha Vision: a GitHub token buried in the firmware

Hanwha Vision, formerly Samsung Techwin, is a subsidiary of the Korean conglomerate Hanwha Group. The company manufactures professional video surveillance cameras. It also has a history in defense: the SGR-A1 sentry robot and the K9 Thunder self-propelled howitzer are among its past product lines. This is no obscure vendor: it is a major player in physical security.

While browsing the Hanwha Vision website, the researcher noticed that camera firmwares were freely available for download. They grabbed an image, decompiled it, and eventually cracked the AES-256-CBC encryption protecting the root filesystem. The key and initialization vector were hardcoded in the updater binary, merely obfuscated through an XOR with a static lookup table. Once the rootfs was extracted, they ran TruffleHog to scan for secrets: a GitHub token surfaced, duplicated across some thirty files.

A well-oiled reverse engineering chain

The path the researcher followed is worth detailing, as it is highly instructive. Here are the key steps:

Retrieving the public firmware from Hanwha Vision’s website
Extraction via Binwalk, which detected an encrypted archive
Bypassing the AES encryption thanks to a key and IV hardcoded in the fwupgrader binary, XOR-obfuscated and reassembled at runtime
Reverse engineering assisted by Claude Code (the researcher mentioned letting the AI work while preparing dinner)
Obtaining a full rootfs and running automated analysis with TruffleHog

The conclusion is damning: the AES key dfa049bb... and the IV 53f92680... are identical across the entire range of affected cameras. With 62% of the 500 tested firmwares extractable using this method, the exposed surface is substantial.

Admin access over hundreds of GitHub repos

The uncovered token is not a simple read-only key. It grants administrator privileges over several hundred repositories in Hanwha’s GitHub organization. That means full access to source code, CI/CD workflows, continuous integration secrets, and potentially the firmware build infrastructure itself.

Worse still: the token appears in files served by the camera’s web admin interface. Anyone accessing the device’s login page could, by inspecting the HTML source and JavaScript assets, retrieve this golden ticket. The researcher notes they did not have a camera on hand to confirm whether the token was actually served client-side, but its presence in the build artifacts makes it highly likely.

The build mistake that set everything off

The root cause has been identified. Hanwha uses Vite to build the user interface for its cameras. A mishandled environment variable caused the entire process.env from the CI job to be injected into the generated files. Here is a reconstructed excerpt:

var W = {
  DATAPORT: "9090",
  GIT_LFS_SKIP_SMUDGE: "1",
  GITHUB_NPM_TOKEN: "ghp_...REDACTED...",
  KUBERNETES_SERVICE_PORT_HTTPS: "443",
  npm_config_userconfig: "/home/docker/.npmrc",
  // etc
}

Beyond the GitHub token, other sensitive data leaked through, such as IP addresses assigned to the U.S. Department of Defense (the 55.101.x.x block). The researcher questions this DoD link and hypothesizes a shared CI platform within the Hanwha Group, where the subsidiary Hanwha Defense USA would legitimately use those resources.

Out of roughly 500 analyzed firmwares, only three contained the token, and it was the same one every time. The impact is therefore limited to a subset of models, but the token’s privilege level makes it a critical incident.

Disclosure and Hanwha’s response

The researcher contacted Hanwha Vision through the address dedicated to security reports. The response came in under 12 hours, confirming the token had been revoked immediately. A responsiveness praised by the discoverer, even as they restate the obvious: this kind of leak should never have reached production. A simple secrets scanner integrated into the CI pipeline would have caught the token before the final build.

Key takeaways

A GitHub token with admin privileges was found in plaintext inside Hanwha Vision camera firmware, duplicated across roughly thirty web interface files.
The cause was a leak of the CI runner’s full process.env, injected into Vite build artifacts during front-end compilation.
The token granted administrator access to hundreds of repositories in the manufacturer’s GitHub organization.
Hanwha revoked the token within 12 hours of the report, an exemplary response from an operational standpoint.
The incident underscores the urgency of automating secrets detection in CI/CD pipelines, especially for IoT devices whose firmware is often publicly accessible.

Have you faced a similar leak in your own projects? Feel free to share your experience in the comments or reach out to me. And to stay in the loop for upcoming analyses, follow the blog.