Leaked Automation Tokens Turned n8n Instances Into Quiet Entry Points

A public-code secret hunt found exposed n8n API tokens that could open live instances and, in some deployments, reach sensitive data and downstream credentials without a software exploit.

Gitea’s Permission Wall Fractures, and That Matters Far Beyond One Token

A critical authorization bug in Gitea raises a familiar but dangerous question: what happens when a token that should stay on the public side of the fence can still touch private branches and CI workflows?

The Real Insider Threat May Wear a Token, Not a Badge

AI agents can stitch together harmless-looking permissions into a harmful outcome unless authorization, delegation, and audit are enforced at the moment each action happens.

A Leak List Is Not Proof, But It Can Still Reveal the Shape of a Breach

Qilin’s publication of Rossum Integration shows how ransomware crews use victim listings as pressure, while the real technical risk may sit inside document workflows, credentials, and downstream finance systems.

Stripe Shadows: Malicious NuGet Package Slips Past Defenses, Pilfers API Tokens