A single click on the wrong repository could have put a developer’s GitHub access at risk. Security researcher Ammar Askar disclosed a zero-day vulnerability in github.dev, GitHub’s browser-based VSCode environment, that could expose GitHub OAuth tokens through a flaw in VSCode webviews. Those tokens could give attackers access to repositories and organizational code available to the affected developer. Microsoft introduced mitigations on June 3, according to Askar’s disclosure timeline, but the bug is a sharp reminder of how much trust modern development workflows place in browser-based coding tools. Understanding how the vulnerability works VSCode is a desktop coding tool owned by Microsoft, the same company that owns GitHub, a code management platform. Over time, Microsoft has tightly integrated both tools to make moving between coding and code management seamless. One example is github.dev, a browser-based version of VSCode that lets developers open and edit repositories directly from GitHub using GitHub OAuth credentials. According to security researcher Ammar Askar, trusted integration is what made the vulnerability possible. Askar notes that the attacker begins by tricking a …