Sourcegraph Administrator Access compromised by Credentials in Publicly Available Code

ArsTechnica reports that a recent security breach at Sourcegraph was
facilitated by credentials embedded in publicly-available source code.

Credentials visible in source or executable code is an obviously bad
practice. Besides the fact that it is obviously dangerous, it has been on
the OWASP list for many years.

The tragedy is that this class of security breach is completely
preventable. There is no reason for putting credentials in source or
executable code.

The ArsTechnica article can be found at:

https://arstechnica.com/security/2023/09/pii-leaked-after-sourcegraph-an-ai-driv …

access bad breach code compromised credentials embedded fact list owasp practice reports security security breach source code sourcegraph visible