Private Mapbox tileset accessible despite token scope restrictions

No, Mapbox does not provide automatic token revocation or rotation when a token is detected in a public repository. If a token with access to a private tileset is leaked, that tileset remains accessible to anyone possessing the token until you manually revoke it via the Mapbox account dashboard or the Tokens API.

Understanding Token Scope vs. Exposure

It is important to distinguish between scope and exposure. A scoped token (e.g., limited to styles:tileset) restricts the actions a user can take—preventing them from deleting your account or uploading new data—but it does not restrict who can use the token. If a token is authorized to read a private tileset, anyone with that token can read that tileset, regardless of where the token was found.

Recommended Recovery Steps

If a token has been exposed, follow these steps to secure your data:

1. Revoke the Token: Immediately delete the compromised token from your Mapbox dashboard.
2. Issue a Replacement: Create a new token with the absolute minimum scopes required for the client application.
3. Update Clients: Deploy the new token to your application. If the token is embedded in a mobile app, this will require an app store update.
4. Audit Usage: Review your account usage statistics for anomalous spikes in traffic that occurred during the window of exposure.

Reducing the Exposure Window

Since Mapbox does not offer automatic expiration or usage-based detection, you must implement external safeguards:

• URL Restrictions: For public tokens used in web applications, configure URL restrictions in the Mapbox dashboard. This limits token usage to specific domains, reducing the utility of a leaked token for browser-based attackers.
• Secret Scanning: Use tools like GitHub Secret Scanning or push-protection to prevent tokens from being committed to version control in the first place.
• Environment-Specific Tokens: Use different tokens for development, staging, and production. This ensures a leak in a dev branch does not compromise production data.
• Avoid Secret Tokens Client-Side: Never embed secret (sk) tokens in client-side code; these should only exist in secure server-side environments.

Verification Note

To verify your current security posture, you can attempt to request a private tileset using a token that lacks the necessary scope; Mapbox should return a 403 Forbidden error. Conversely, testing a leaked but still active token will confirm that scope alone does not prevent unauthorized access.