--- title: My security camera shipped a GitHub admin token in its... description: A security researcher analyzed firmware from a Hanwha Wisenet XNP-9300RW security camera and discovered a GitHub admin token embedded in the login page... canonical: https://daily.dev/posts/my-security-camera-shipped-a-github-admin-token-in-its-login-page-hpbnugrql twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: My security camera shipped a GitHub admin token in its login page | daily.dev og:description: A security researcher analyzed firmware from a Hanwha Wisenet XNP-9300RW security camera and discovered a GitHub admin token embedded in the login page... og:url: https://daily.dev/posts/my-security-camera-shipped-a-github-admin-token-in-its-login-page-hpbnugrql og:image: https://api.daily.dev/og/posts/hPbnugRqL.png og:image:alt: My security camera shipped a GitHub admin token in its login page og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # My security camera shipped a GitHub admin token in its login page **[Hacker News](https://daily.dev/sources/hn)** · 6 min read · 0 upvotes · 0 comments ## Summary A security researcher analyzed firmware from a Hanwha Wisenet XNP-9300RW security camera and discovered a GitHub admin token embedded in the login page JavaScript. The firmware used XOR-obfuscated AES encryption (with hardcoded key and IV) to protect the rootfs. The token appeared in ~30 files because the Vite build process was serializing the entire CI environment (process.env) into the bundle, inadvertently leaking the GitHub token with admin access to hundreds of repositories. The firmware also contained environment variables pointing to IP addresses assigned to the US Department of Defense, possibly linked to Hanwha's parent company's defense subsidiaries. After responsible disclosure, Hanwha revoked the token within 12 hours. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 218 comments across hackernews (as of 2026-07-24). **TL;DR:** The community is largely critical of IoT and security camera firmware security practices, with wide-ranging side discussions about IP address misuse (DoD space, RFC1918 alternatives), IPv6 adoption struggles, and the general hopelessness of hardware vendor security. The mood is sardonic and experienced. **Sentiment:** 10% positive · 40% mixed · 50% skeptical **The case for** - LLMs have lowered the barrier to reverse-engineering obfuscated firmware, making security-by-obscurity even less viable. - Using DoD or other non-RFC1918 public IP space internally can serve legitimate niche purposes like avoiding NAT collisions across many interconnected networks. - Open firmware projects (OpenIPC, Thingino) and local-protocol devices (Zigbee/Z-Wave) offer meaningful alternatives to proprietary IoT apps. **The pushback** - IoT and security camera vendors routinely ship hardcoded credentials, baked-in external IP addresses, and keys embedded in APKs, with security clearly not a priority. - IPv6 adoption is hampered by poor ergonomics, confusing address provisioning (SLAAC vs DHCPv6), and the perception that NAT already 'solved' the address problem cheaply. - Hardware companies using public IP ranges (like 1.1.1.0/24 or DoD space) internally causes real-world routing and troubleshooting chaos. - Security cameras streaming to foreign or state-backed corporate clouds are a privacy risk that users casually accept for convenience. **By community** - hackernews (skeptical): Commenters are broadly cynical about IoT security, amused by networking misconfigurations, and pessimistic about IPv6 adoption, with many sharing war stories of vendor incompetence. **Hottest debate:** Whether IPv6 was a well-designed successor to IPv4 or an over-engineered failure that NAT made unnecessary, with strong opinions on both sides. **Open questions** - Is there a plug-and-play IP camera with manufacturer-supported open firmware that isn't a bare dev kit? - Will IPv6 ever achieve meaningful end-user adoption given its ergonomic and tooling shortcomings? - What is the actual story behind DoD IP addresses being baked into the Korean security product's firmware? **Highlights** > The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product. > — [grommz on hackernews · 7 comments](https://news.ycombinator.com/item?id=49035049) > There's also some irony in people happily ignoring that so many of these products live-stream the inside view of their homes and offices to some foreign corporate cloud - and in many Chinese security cameras, a state-backed corporation's cloud. Because, wow, it really is convenient. > — [daneel\_w on hackernews](https://news.ycombinator.com/item?id=49036865) > LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that. > — [IshKebab on hackernews · 2 comments](https://news.ycombinator.com/item?id=49035853) > I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said. > — [mr\_mitm on hackernews · 2 comments](https://news.ycombinator.com/item?id=49037541) > Note to self, never buy any hardware product, move to a yurt in the woods, start an alpaca ranch, write a manifesto > — [walrus01 on hackernews](https://news.ycombinator.com/item?id=49036942) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49034292) · 220 points · 218 comments ## Similar posts on daily.dev - [Novo Nordisk Breach Exposes Software Development Pipeline Risk](https://daily.dev/posts/novo-nordisk-breach-exposes-software-development-pipeline-risk-mllmtnmow) · Dark Reading · 0 upvotes · 0 comments - [Popular Codex npm package stole developer tokens for a month](https://daily.dev/posts/popular-codex-npm-package-stole-developer-tokens-for-a-month-szppthxmu) · The Next Web · 1 upvotes · 1 comments - [Attack targeting OpenAI Codex users exposes AI software supply chain risks](https://daily.dev/posts/attack-targeting-openai-codex-users-exposes-ai-software-supply-chain-risks-x1yygxvy1) · CSO Online · 0 upvotes · 0 comments - [Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens](https://daily.dev/posts/legitimate-looking-codex-remote-ui-secretly-steals-your-ai-tokens-a6l6swlyp) · Aikido Security · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/my-security-camera-shipped-a-github-admin-token-in-its-login-page-hpbnugrql) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"My security camera shipped a GitHub admin token in its login page","url":"https://daily.dev/posts/my-security-camera-shipped-a-github-admin-token-in-its-login-page-hpbnugrql","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/my-security-camera-shipped-a-github-admin-token-in-its-login-page-hpbnugrql"},"datePublished":"2026-07-24T14:00:08.115Z","dateModified":"2026-07-24T18:43:49.386Z","description":"A security researcher analyzed firmware from a Hanwha Wisenet XNP-9300RW security camera and discovered a GitHub admin token embedded in the login page...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e6d106777eff9ca9122353158db2371b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e6d106777eff9ca9122353158db2371b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/my-security-camera-shipped-a-github-admin-token-in-its-login-page-hpbnugrql","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,reverse-engineering","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"My security camera shipped a GitHub admin token in its login page"}]} ```