# \[ANN\] \`julia\_pod\` v0.4.0: Removes A Security Footgun

**URL:** https://discourse.julialang.org/t/ann-julia-pod-v0-4-0-removes-a-security-footgun/95167
**Category:** Tooling
**Tags:** announcement
**Created:** [February 24, 2023, 9:20pm UTC](https://discourse.julialang.org/t/ann-julia-pod-v0-4-0-removes-a-security-footgun/95167 "2023-02-24T21:20:57Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![omus](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/omus/32/402_2.png) [@omus](https://discourse.julialang.org/u/omus)
#### Post date: [February 24, 2023, 9:20pm UTC](https://discourse.julialang.org/t/ann-julia-pod-v0-4-0-removes-a-security-footgun/95167/1 "2023-02-24T21:20:57Z")

</div>

The [`julia_pod`](https://github.com/beacon-biosignals/julia_pod) tool (versions \< v0.4.0) included an optional feature to store a user’s GitHub Personal Access Token (PAT) as a Kubernetes (K8s) secret, allowing you to add private packages from within an interactive K8s pod.

While useful in contexts where the PAT has limited scope and the target K8s namespace is secure, we’ve decided that this feature could be a security risk for unsuspecting users who might accidentally leverage this feature in insecure contexts, as it renders the user’s PAT accessible to any other entity with access to the namespace. In a worst case scenario, a malicious actor with access to a leaked PAT could impersonate that PAT’s associated user via the GitHub API.

As such, we’ve decided to remove this particular feature from `julia_pod` v0.4.0 entirely. Any `julia_pod` users which have used the `GITHUB_TOKEN_FILE` option in a shared K8s namespace can, as a precaution, rotate any used GitHub PATs by going to [https://github.com/settings/tokens](https://github.com/settings/tokens).

Going forward, `julia_pod` will only use the `GITHUB_TOKEN_FILE` to allow adding private Julia packages during building of Docker images. Interactively adding Julia packages will prompt you to manually enter your credentials. Please note that `julia_pod` makes use of [Docker BuildKit secrets](https://docs.docker.com/engine/reference/builder/#run---mounttypesecret) to ensure that PATs are not baked into any Docker image layers.