private keys exposed on the GitHub repository

How it was found

Summary:

When I searched Github for sensitive information I found some privet key in GitHub repository. these are private RSA key and private server key, which could be used for unauthorized access.

Steps To Reproduce:

VISIT THESE LINKS: Repository :

EX: https://github.com/mcu-tools/mcuboot/blob/137d79717764ed32d5da4b4b301f32f81b2bf40f/enc-x25519-priv.pem

https://github.com/mcu-tools/mcuboot/blob/137d79717764ed32d5da4b4b301f32f81b2bf40f/root-ed25519.pem

(This is just an example)

This is the link that contains it all privet key :-

https://github.com/mcu-tools/mcuboot/search?p=1&q=extension%3Apem+private

Supporting Material/References:

https://hackerone.com/reports/50170 https://hackerone.com/reports/638401

Impact

1).Private key leakage 2). All of the servers using this key will be compromised