Loading story…
A security researcher discovered that a Home Depot employee had inadvertently published a private GitHub access token online, which remained exposed for approximately a year. The token granted access to hundreds of private source code repositories, as well as critical internal systems such as order fulfillment, inventory management, and code development pipelines. The researcher attempted to alert Home Depot multiple times but received no response until the issue was escalated through media contact, after which the exposure was remediated.
The exposed credential provided not only read but also write permissions to sensitive repositories and cloud infrastructure, significantly increasing the risk of unauthorized modifications or data breaches. Home Depot has since removed the leaked token from public view, but the incident highlights the dangers of credential leakage and the importance of timely response to security disclosures. The company has hosted much of its developer infrastructure on GitHub since 2015, making such exposures particularly impactful.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Home Depot removed the credential from public view only after TechCrunch contacted the company for comment. This action ended the public exposure described by the researcher.
After identifying the exposed token, Zimmermann reportedly tried several times to notify Home Depot about the issue. According to the reports, the company did not respond to those outreach attempts.
Security researcher Ben Zimmermann found the leaked credential and determined that it could be used to access private GitHub repositories and parts of Home Depot's cloud infrastructure. His findings established the scope and duration of the exposure.
For roughly a year after the token was published, the exposed credential reportedly allowed access to internal Home Depot resources, including systems tied to order fulfillment and inventory management. The exposure persisted without remediation during that period.
A private GitHub access token belonging to a Home Depot employee was accidentally exposed in a public GitHub repository in early 2024. The credential reportedly granted write access to private Home Depot repositories and access to cloud-connected internal systems.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub confirmed that an attacker accessed internal repositories after a malicious Visual Studio Code extension was installed on an employee device, leading to the exfiltration of roughly **3,800 GitHub-internal repositories**. GitHub said it detected and contained the intrusion, removed the malicious extension version, and isolated the affected endpoint. Independent analysis of a leaked file list reportedly found **3,874 unique** `.tar.gz` archive names, broadly matching GitHub’s estimate of the stolen data. The exposed repositories reportedly include projects tied to **security tooling, identity systems, CI/CD, infrastructure-as-code, GitHub Actions, Terraform, certificates, and Copilot-related work**, increasing the risk of follow-on supply-chain abuse and targeted social engineering. The threat actor, using the alias **TeamPCP**, is said to be offering the dataset for sale on an underground forum for more than **$50,000**, raising concerns that internal code and operational details could be weaponized against GitHub and its customers.
Jul 12, 2026
Security researchers at Flare have discovered that over 10,000 public Docker Hub container images are leaking sensitive secrets, including live credentials for production systems, cloud services, CI/CD pipelines, and AI platforms. The exposed data affects more than 100 organizations, ranging from small businesses to a Fortune 500 company and a major national bank. Many of these secrets are not placeholders but active credentials, with nearly 4,000 API keys for large language models such as OpenAI, HuggingFace, Anthropic, Gemini, and Groq found in the wild. In some cases, a single image contained five or more exposed secrets, significantly increasing the risk of unauthorized access to critical infrastructure. The leaks are often the result of developers inadvertently including sensitive files and hard-coded keys in Docker images, which are then published to public repositories. A notable portion of the exposed secrets comes from "shadow IT" accounts—personal or team Docker Hub registries outside formal corporate oversight—making them difficult for organizations to monitor and secure. The majority of affected organizations are in the software development sector, but the exposure also impacts finance, banking, and AI companies. This incident highlights the urgent need for improved security hygiene and automated scanning in the container development lifecycle to prevent inadvertent credential leaks.
Jun 29, 2026
Truffle Security found that **543,699 unique credentials** exposed in public GitHub code were still valid when tested on July 27–28, 2026. Its analysis linked those live secrets to 1,103,438 exposures across files and forks in The Stack v3, a 15.9 TB code dataset assembled from about 224 million public repositories. The credentials included API keys, access tokens, database connection strings, and cloud service-account credentials; the median duration of public exposure was 784 days, and one active AWS key had been committed in 2009. GitHub push protection reduced exposure density by 53% for supported secret types, but it does not remediate historical commits and has incomplete coverage: 51.8% of active credentials used formats not blocked by default protection, while 36.8% were committed after push protection became the default for free users. Google Cloud service-account credentials, MongoDB connection strings, and Google API keys were among the largest groups of usable secrets. Because revocation is not mandatory after GitHub reports findings to providers, organizations should scan full Git histories, immediately revoke or rotate exposed credentials, investigate potential abuse, adopt short-lived secrets, and automate alert-to-revocation workflows; the exposures may also persist in downstream AI-training datasets after removal from source repositories.
Oct 1, 2026