March 2024 Summaries

The Mintlify MDX VSCode extension allows developers to easily incorporate components from a comprehensive library into their documentation within Visual Studio Code (VSCode), providing a more efficient workflow for editing and maintaining documentation. With the introduction of this extension, users can quickly add supported components such as `Card`, `Steps`, and `Tabs` by typing `<` followed by a few characters, with Intellisense guiding them to the full component name. The extension also supports surround snippets for components that require content encapsulation, making it easier to incorporate these elements into documentation. Furthermore, users can set a keyboard shortcut to quickly trigger the extension modal and access more features in the upcoming weeks.

Mintlify has introduced a VSCode extension designed to enhance the documentation writing process by providing IntelliSense and snippets for its component library, allowing users to easily incorporate components such as Cards, Steps, and Tabs directly within their preferred editor. This extension supports both individual and "Surround" snippets to streamline content encapsulation, offering a more efficient way to write and maintain documentation without extensive review of documentation syntax. Available on the Visual Studio Marketplace, the extension simplifies component integration and promises further upgrades, encouraging users to engage with the community for feature requests and updates.

Mintlify has strengthened its commitment to privacy and security after a March security incident revealed vulnerabilities in their systems. The company has conducted an investigation with external security partners to identify weaknesses exploited during the attack and has rolled out numerous improvements to its security infrastructure. These measures include encrypting sensitive user data at rest, deprecating the storage of GitHub OAuth tokens, and introducing a responsible disclosure program to encourage proactive identification and reporting of security issues. Additionally, Mintlify has improved authentication within its transactional email infrastructure, reduced its attack surface area by removing non-critical endpoints, and replaced internal admin tokens with session authentication to limit API endpoint access to authenticated users only.

Mintlify's response to a security incident in March 2024 involves a comprehensive overhaul of its security measures to prevent future vulnerabilities. Key improvements include implementing AES256-GCM encryption for data at rest, ceasing the storage of GitHub OAuth tokens and internal admin tokens, and replacing them with session-based access controls. Furthermore, the company has introduced a responsible disclosure program to encourage proactive identification of security issues, enhanced email infrastructure authentication, and reduced the attack surface area by eliminating non-critical endpoints. These actions reflect Mintlify's commitment to safeguarding customer data and maintaining transparency with its users.

We've detected from our logs that 91 GitHub tokens were compromised. The users have been notified, and we're working with GitHub to identify whether the tokens were used to access private repositories. We received confirmation that GitHub tokens stored within our databases were used to access a customer's repository, although we cannot confirm if other instances occurred. To address this incident, we revoked all GitHub token access, rotated our admin access tokens, implemented stringent security measures to prevent further unauthorized access, patched the vulnerability that led to the exposure of our admin access tokens, and partnered with third-party cybersecurity vendors for an investigation. We have also taken additional steps such as enhancing endpoint authorization protocols, rotating internal access tokens, and conducting a penetration test, while collaborating with leading cybersecurity firms to fortify our defenses against potential future attacks.

Mintlify experienced a security incident on March 1, 2024, when unauthorized access to admin tokens led to the compromise of 91 GitHub tokens and confirmed access to at least one customer repository. In response, the company immediately revoked all tokens, implemented stringent security measures, and partnered with cybersecurity firms for a thorough investigation. The incident was detected after receiving an email about potential security concerns, which led the team to discover unauthorized requests from an unrecognized device targeting sensitive API endpoints. Despite confirming only one instance of unauthorized repository access, Mintlify took comprehensive steps to bolster security, including patching vulnerabilities, rotating access tokens, and enhancing endpoint authorization protocols. They are also collaborating with cybersecurity firms to prevent future breaches, enhancing monitoring systems, and launching a bounty program to encourage the reporting of security vulnerabilities. Mintlify remains committed to transparency and user security, ensuring that similar incidents do not occur again.

Mintlify has shipped several updates in February 2024, including a new dashboard experience with improved navbar, update logs, and tab versioning setup. The dashboard now allows users to toggle between projects and provides more detailed information about changes made during an update. Wildcard redirects have also been added, allowing users to preserve SEO for original pages when making architectural changes. Additionally, the CLI has been upgraded to detect errors in metadata and show their positions during local development.

In February 2024, Mintlify introduced several key updates, including the implementation of wildcard redirects to maintain SEO during structural changes, a revamped dashboard featuring enhanced navigation, update logs, and improved project management capabilities, and full tab versioning support for API documentation. The new dashboard enhancements allow users better access to support, GitHub app configuration, and user management, while also providing detailed update logs and easier project toggling. Additionally, the CLI has been upgraded to improve error detection, particularly for frontmatter parsing issues in markdown documentation. These updates aim to streamline user experience and improve documentation management.