Looks like they could have invested more energy in the processes and security rather than catching up "innovation" craze that much
So many companies internal codebases are of approximately zero value to any outsider. The code is only a small proportion of the business.
Given a lot of their software is OSS or OSS based there's a probable chance non-OSS is runnable and usable outside the company
The product is mostly "standalone" in that it doesn't require integrations with 3rd parties unlike, say, banking software
The Enterprise edition seems to focus a lot on meta-information about grafana itself: the most frequently accessed dashboard, who is viewing the current dashboard etc.
Theres also group-sync, I guess, which is useful, but honestly the selling point of enterprise is the support I think.
In fact, I might buy enterprise following this, the fact that so much is in the base product gives me the warm fuzzies.
Critical vulnerability in that source code could enable further access to other production systems or databases.
Edit: typo
https://github.com/grafana/grafana
/s
I don't much like the securityese dialect of bureaucratese, but doesn't it make more sense as "We recently discovered that a threat actor obtained a token with access to the Grafana Labs GitHub environment, enabling the unauthorized party to download our codebase" ?
you can't just drop in buzzwords willy nilly, they buzz better in the right places.
