{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:02:57.453Z",
  "tag": {
    "id": "secrets",
    "label": "Secrets",
    "isStack": false,
    "url": "https://pwn.watch/t/secrets",
    "feed": "https://pwn.watch/t/secrets/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 5
  },
  "incidents": [
    {
      "slug": "hugging-face-spaces-secrets-leak",
      "title": "Hugging Face Spaces secrets accessed without authorization",
      "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak",
      "json": "https://pwn.watch/i/hugging-face-spaces-secrets-leak.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Hugging Face Spaces",
      "tags": [
        "ai",
        "hosting",
        "hugging-face",
        "secrets",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-05-31",
      "closedAt": "2024-05-31",
      "updatedAt": "2024-05-31",
      "summary": "Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.",
      "xPost": null
    },
    {
      "slug": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "title": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion",
      "json": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Cloudflare internal Atlassian environment",
      "tags": [
        "cloudflare",
        "okta",
        "atlassian",
        "confluence",
        "secrets"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-11-14",
      "closedAt": "2024-02-01",
      "updatedAt": "2024-02-01",
      "summary": "A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.",
      "xPost": null
    },
    {
      "slug": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "title": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023",
      "json": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Azure Storage (SAS token in a GitHub repo)",
      "tags": [
        "ai",
        "microsoft",
        "azure",
        "github",
        "secrets",
        "misconfiguration",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-06-22",
      "closedAt": "2023-09-18",
      "updatedAt": "2023-09-18",
      "summary": "A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.",
      "xPost": null
    },
    {
      "slug": "github-rsa-ssh-host-key-exposed-2023",
      "title": "GitHub's RSA SSH host key briefly exposed in a public repo",
      "url": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023",
      "json": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "GitHub (github.com SSH)",
      "tags": [
        "devtools",
        "github",
        "ssh",
        "secrets"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-03-24",
      "closedAt": "2023-03-24",
      "updatedAt": "2023-03-24",
      "summary": "GitHub's private RSA SSH host key for github.com was briefly exposed in a public repository. GitHub rotated it as a precaution, which meant anyone connecting over SSH with RSA saw a host key mismatch warning until they updated known_hosts.",
      "xPost": null
    },
    {
      "slug": "circleci-security-incident-rotate-all-secrets-2023",
      "title": "CircleCI breach: rotate every secret",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023",
      "json": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "CircleCI",
      "tags": [
        "devtools",
        "circleci",
        "ci-cd",
        "secrets",
        "infostealer",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-01-04",
      "closedAt": "2023-01-13",
      "updatedAt": "2023-01-13",
      "summary": "Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "hugging-face-spaces-secrets-leak",
      "incidentTitle": "Hugging Face Spaces secrets accessed without authorization",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-31",
      "title": "Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens",
      "body": null,
      "sourceUrl": "https://huggingface.co/blog/space-secrets-disclosure",
      "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-02-01",
      "title": "Cloudflare publishes its full write-up",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-23",
      "title": "Cloudflare detects the attacker on its self-hosted Atlassian server",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-14",
      "title": "Attacker begins reconnaissance with credentials from the Okta compromise",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "Public disclosure by Wiz and Microsoft",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-24",
      "title": "Microsoft revokes the SAS token",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-22",
      "title": "Wiz reports the exposure to Microsoft",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "github-rsa-ssh-host-key-exposed-2023",
      "incidentTitle": "GitHub's RSA SSH host key briefly exposed in a public repo",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-24",
      "title": "GitHub replaces its RSA SSH host key; users must update known_hosts",
      "body": null,
      "sourceUrl": "https://github.blog/news-insights/company-news/we-updated-our-rsa-ssh-host-key/",
      "url": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-13",
      "title": "Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/jan-4-2023-incident-report/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-04",
      "title": "CircleCI tells all customers to rotate every secret stored in CircleCI",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/january-4-2023-security-alert/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    }
  ]
}