Docker Hub reassigned personal access tokens without rotating their secrets for 25 months
On October 12, 2026, Docker disclosed that converting an account into an organization reassigned personal access tokens to a new owner without rotating the secret. Treat an image namespace as a weak trust signal: switch to organization tokens and sign your images.