Sunday 26 July 2026 11:23:05 GMT+02:00
Netcrook
#token leak
One WordPress Email Plugin, One Missing Lock, and a Very Large Secret Trail
A disclosure flaw in Gravity SMTP turned a mail helper into a potential source of API keys, tokens, and site fingerprints, showing how small permission mistakes can create outsized exposure.
A Package That Stole Files and Spilled Its Own GitHub Secret
A malicious npm package exposed its operator’s private GitHub token, underscoring supply-chain risks and the dangers of exposed credentials.
The Forgotten Token That Opened Grafana’s Code Vault
A supply-chain incident did not stop at the package registry; one unrotated GitHub credential appears to have kept a door open into source repositories.
The Quiet Leak in the Build Chain: How a Token Format Change Put Composer on Alert
A validation bug in a PHP toolchain turned a routine authentication failure into a secrets-disclosure risk inside CI logs, showing how upstream token changes can ripple into downstream security.