Yelp · Report #273630
Leaking sensitive information lead to compromise employer API keys
Validstatus
highseverity
12upvotes
9 Nov 2017disclosed
Summary
The configuration file of an internal IRC bot (which included credentials to internal services and some external services used by Yelp developers) was inadvertently included by an employee in a personal public GitHub repository. The repository was taken down and the affected credentials rotated.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.