My security camera shipped a GitHub admin token in its login page

A security researcher discovered a GitHub admin token hardcoded in Hanwha security camera firmware that had administrative access to hundreds of repositories in their organization. The researcher was able to extract the camera's encrypted rootfs by reverse-engineering the firmware updater binary and finding hardcoded AES encryption keys, then used automated tools to identify the exposed credentials duplicated across approximately 30 files.