A source code leak is the theft or public release of application code, such as repository contents, build scripts, configuration files, or Git history. It matters because code can expose business logic, hidden endpoints, security controls, and sometimes embedded secrets like API keys, tokens, or database connection strings. Even without credentials, attackers can study the code to understand how an application works and where its weak points are.
In real attacks, stolen code is often used to improve extortion claims, speed up vulnerability discovery, or support follow-on intrusion against related systems. It can also help attackers identify backup formats, authentication flows, and integration points with third-party services. Defenders reduce the risk by protecting source repositories with strong access control, secret scanning, branch protections, and encrypted backups. If code is exposed, teams should assume secrets may be compromised, rotate credentials, review commit history, and audit for hard-coded sensitive data.