Deleting a secret from your Docker image doesn't delete it from your build history

An autonomous hacking agent found a live GitHub admin token in a public Docker image from Baseten: the token from March 2023 persisted in the build history and in July 2026 still granted admin access to internal repositories. The secret was not in filesystem layers but in the image config — a RUN command exposed GITHUB_TOKEN in history[].created_by.

• GitHub token from March 2023 remained valid in July 2026
• Secret stored in image metadata, not filesystem layers
• Secret scanners checking only blobs do not find it
• Fix: rotate token and rebuild without passing the secret