2

I've noticed that once I reply to github questions via email, the reply appears on the issue page with action links (as it should be), but it also has authorization keys.

Comment of an issue as seen in github:

[... HERE GOES TEXT WRITTEN IN EMAIL BY ME ...]
… [<- THIS IS CLICKABLE AND SHOWS THE TEXT BELOW]

On Mon, Jan 7, 2019, 12:34 James ***@***.***> wrote:
 [... HERE GOES TEXT WRITTEN IN GITHUB BY ANOTHER USER ...]

 —
 You are receiving this because you commented.
 Reply to this email directly, view it on GitHub
 <#25?email_source=notifications&email_token=JVIDJRSLJNC[...]#issuecomment-123456789>,
 or mute the thread
 <https://github.com/notifications/unsubscribe-auth/LKJRNVS[...]>

Is my account now compromised in any way (e.g. a third-party can unsubscribe me from a thread)?

0

Summary

No, it does not. Everything is safe.

Details

I've contacted GitHub support about this, and this is their answer:

I've confirmed with our notifications team that the email_token parameter is not sensitive nor poses any security risk. The token is just used for tracking clicks in our notification emails.

I've opened an issue with our team to see if we can tidy these email replies up a bit as I can understand seeing a "token" inserted into comments is worrying!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.