CrowdSec’s Token Survived Employee Departure
An ex-developer’s laptop OAuth credential let intruders copy around 170 CrowdSec repositories over nine minutes on 22 May 2026. GitHub traced it to TanStack. Handover access survived departure until 25 May.
The company reports no production or database access, or repository, package or build changes. Exposed were 83 monitoring email addresses, 51 prospective investors’ names, email addresses plus funding context, and a probed, notification-only AWS SNS credential. Other secrets were revoked or unusable online. Beyond those contacts, no client or partner data was reported exposed.
Infrastructure access ended; delegation persisted. This company reconstruction, rather than independent audit, complements 27 August 2026 coverage.
Close delegated routes
- Revoke OAuth, personal-access, SSH, signing and automation credentials at departure.
- Inventory authorised integrations, repository permissions, granting users and devices.
- Require credential expiry and reauthorisation.
- Alert on mass downloads, new devices, locations and dormant identities.
- Scan stolen material; check secrets’ validity and downstream reach.
- Preserve evidence distinguishing theft from tampering; report only supported findings.
Report: 18 September 2026; time unspecified.
