Security Audit: Public Wiki Exposure (June 18–23, 2026)¶
Summary¶
| Field | Value |
|---|---|
| Detected | 2026-06-22 (GAV team — Niklas Hultén, DevOps Engineer III) |
| Exposure window | 2026-06-18 ~11:52 → 2026-06-22 (GitHub Pages public: True) |
| Duration | ~4 days |
| Remediated | 2026-06-22 (pages set back to public: False, auth required) |
| polyfill.io removed | 2026-06-23 15:29 CEST |
| Root cause | GitHub Pages for private repos requires public: True to bypass auth redirect; this was set during initial deployment troubleshooting |
| Data classification | Internal system names only — no credentials, no customer data, no proprietary measurements |
What was exposed¶
The wiki at panel.mlapps.olink.systems was publicly accessible (no GitHub login required) for approximately 3 days.
Content on wiki pages during exposure¶
| Item | Page | Risk | Details |
|---|---|---|---|
| "Maximus LOD" | architecture.md | Low | Internal system name in a mermaid diagram label. No data values. |
| polyfill.io CDN script | All pages (via mkdocs config) | None | Compromised supply-chain CDN was referenced. See below. |
Content in README.md (repo remained private — not directly exposed)¶
| Item | Risk | Details |
|---|---|---|
| "Maximus" screening system | Low | Name only, no parameters or data |
| "mAb/pAb inventory" exists | Low | Reveals Olink tracks antibody types internally |
| "KOL wishlists" exist | Low | Reveals key opinion leader engagement process |
| "Splenocyte availability" tracked | Low | Internal capability reference |
| "Royalty antibody list" exists | Low | Reveals IP/licensing tracking |
| "Customer RFIs / CRM / Zendesk" | Low | Reveals internal tooling choices |
| "Customer win/loss analysis" | Low | Reveals competitive intel process exists |
What was NOT exposed¶
- No: No actual data values (LOD numbers, protein lists, assay parameters)
- No: No API keys, tokens, secrets, or credentials
- No: No AWS infrastructure details (account IDs, endpoints, ARNs)
- No: No customer data, names, or project information
- No: No proprietary algorithms or assay specifications
- No: No source code (repo remained private throughout)
polyfill.io Assessment¶
polyfill.io was included in mkdocs.yml as a JavaScript CDN for MathJax browser compatibility. This domain was compromised in a 2024 supply-chain attack (sold to malicious actor who injected redirect/ad scripts).
Impact assessment: - The script was a client-side browser resource — it cannot access server-side secrets - Modern browsers and ad-blockers have blacklisted the domain since 2024 - The wiki required GitHub authentication during most of the window - No evidence of successful script execution or data exfiltration - Removed 2026-06-23
Remediation Actions¶
| # | Action | Status | Date |
|---|---|---|---|
| 1 | Set GitHub Pages public: False |
Done Done | 2026-06-21 |
| 2 | Remove polyfill.io from mkdocs.yml | Done Done | 2026-06-23 |
| 3 | Verify wiki requires GitHub auth | Done Confirmed (x-pages-private: 1) |
2026-06-23 |
| 4 | Audit all wiki content for internal terms | Done Done | 2026-06-24 |
| 5 | File incident report | Done This document | 2026-06-24 |
Lessons Learned¶
- Never set
public: Trueon GitHub Pages for private repos — use auth-gated access only - Audit third-party CDN references before adding to config — polyfill.io should have been caught
- Internal system names should not appear in documentation that could become public — use generic terms ("internal LOD system" instead of "Maximus")
Edit this page{ .md-button } File a review comment{ .md-button .md-button--primary }