HexBrain

Yelp · Report #273630

Leaking sensitive information lead to compromise employer API keys

Validstatus
highseverity
12upvotes
9 Nov 2017disclosed

Summary

The configuration file of an internal IRC bot (which included credentials to internal services and some external services used by Yelp developers) was inadvertently included by an employee in a personal public GitHub repository. The repository was taken down and the affected credentials rotated.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original