On September 16, the team disclosed a May 2026 source-code exposure involving their GitHub repositories. The codebase is split between a public Free Open Source Security Engine and private repositories that held the SaaS console source, AWS cloud routines, connectors and automations. Approximately 300 repositories were exposed when counting the 130+ public ones, though that number mainly reflects repository subdivision rather than a large volume of unique material. An API token used by the CI/CD system was present in the leak, but no client data, logins, passwords, organization names, personal data or client logs were exposed. The team hunted for any credentials or tokens that would allow lateral movement and found none. Much of the leaked private code has evolved since May, and routine audits were in place.
The incident is limited to the company: leaked code has value but cannot reproduce the organization’s network effect or be readily repurposed elsewhere, so it does not pose immediate harm. Investigation attributes the intrusion vector to a compromised Tanstack component backdoored to extract a key granting repository read access, mirroring the Mistral AI case; the vulnerability was exploitable only for a short window in May. Remediation steps included rotating all required tokens and credentials and instituting ongoing monitoring for abnormal activity. The disclosure thanks Fuites Infos for reporting the issue.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Internal documents reveal Microsoft and OpenAI considered news scraping for AI training as an unprecedented theft of labor. They also acknowledged that this practice threatens the future of news publishers and could harm the web ecosystem. (arstechnica.com)
AI companies are pushing industry-changing solutions built on questionable ethics, exploitation, and lack of security. The hype and competition among industry leaders have led to risky projects with little regard for societal impact or safety. (netmeister.org)
Missouri governor orders guardrails on Flock cameras and automatic license plate readers to enhance privacy and safety. The move aims to regulate the use of surveillance technology across the state. (stlpr.org)
Public job referral programs can lead to spam and unqualified candidates being contacted, as recruiters use keywords to find potential applicants. This diminishes the value of genuine referrals, turning them into incentives for mass outreach rather than meaningful endorsements. (blog.melashri.net)
A targeted campaign is attempting to compromise Rust community members and crate owners through social engineering and fake profiles. Rust advises users to be cautious with calls and verify account security to prevent malware infections. (blog.rust-lang.org)
Revolut faces a $3 million ransom demand after hackers impersonated officials and stole data from hundreds of cryptocurrency customers. The breach specifically targeted about 680 users with suspected crypto holdings, raising safety concerns among victims. (theguardian.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.