New comment by thrownaway22 in "We got admin access to Baseten's production GitHub"

thrownaway22 — Tue, 15 Sep 2026 19:04:14 +0000

Baseten carries the Soc 2 Type II and HIPAA Compliant logos on its front page. They also have logos for customers including: OpenEvidence (medical related, used by almost 2/3 of physicians in the US, claim HIPAA compliance), Harvey (legal related, claim "binding terms on data protection, data access, incident response SLAs, and other controls aligned with SOC2, ISO, GDPR and other standards.")

From TFA:

> That token had admin and push access to Baseten's main product repo, the GitOps repo that drives their clusters, and their Homebrew tap, plus read/write access to other private repositories including specific repos per customers.

> The image build dated to March 2023, and the token still worked when we found it in July 2026.

What are the legal implications here?

Hacker News: thrownaway22

New comment by thrownaway22 in "We got admin access to Baseten's production GitHub"