Post #3649826
2026-05-14 13:08 UTC
@forgejo@floss.social Could you elaborate on what "internal server credentials" you're talking about?
There is some speculation about whether that means a user account on a Forgejo instance or if it means (as I read it) "internal" credentials that are only available if a user has actual server access.
But it's ambiguous, which is bad for folks who are trying to understand the actual security implications. A more detailed explanation would be great. Thanks!
Replies (1)
-
@crystal@hachyderm.io 2026-05-14 22:34
@jzb@hachyderm.io @forgejo@floss.social You are correct, it requires either admin credentials or an internal access token that Forgejo uses to communicate with itself in some situations. Recommend checking the security team's full statement here https://codeberg.org/forgejo/website/issues/839#issuecomment-14208296 That internal token is discussed here if you're curious about it https://codeberg.org/forgejo/forgejo/issues/12387