A critical bug in Docker Hub's access controls meant some personal access tokens, including the ones I use to publish compose-lint , a security linter for Docker Compose files, could have been used by someone else. Not the email you want on a Friday afternoon. I actually got two of them on Friday, October 2, about an hour apart. The one I happened to open first was addressed to me as the organization owner. It was pretty vague and said there was no action for me to take, so I skimmed it and ...