Terraform state readable with the Read role (any account, on public and internal repositories) issue #256 closed: completed andymccall opened this 17 days ago · 0 comments

Found 2026-10-18 while designing issue #255. The state backend (issue #252) lets a person read a state with the repository's Read role. Every signed-in account has Read on public and internal repositories, so anyone with a repo:read token can GET their Terraform state, which often holds secrets (provider outputs, passwords, keys).

Fix: reading a state needs the Write role, as changing one does (jobs of the repository keep their access). The Terraform state page lists states only to people with Write access; others see the backend block.

Exposure: since the issue #252 deploy (2026-10-18 ~03:25 BST). Check terraform_states on oxygenhub.io for any state in a public or internal repository.