A developer at a third-party integration firm inadvertently committed active production API keys and service account credentials for GlobalChain (fictional) to a public GitHub repository. The repository was created as part of a tutorial project and remained publicly accessible for approximately 11 days before being made private.
What Was Exposed
- Two production REST API keys for GlobalChain's freight management API
- A service account username and password with read/write access to shipment records
- A Webhook signing secret used to validate inbound event payloads
Potential Impact
The API keys carry permissions including: reading active shipment manifests, modifying delivery records, and accessing customer PII associated with shipments. The signing secret exposure could allow an attacker to forge webhook events, potentially manipulating downstream logistics workflows.
Timeline
- September 9, 2026: Repository created and pushed with credentials in plaintext
- September 20, 2026: Threxar identifies exposure via automated repository scanning
- September 20, 2026: GlobalChain notified; keys revoked within 4 hours of notification
Recommended Actions
All organisations using the GlobalChain freight API should:
- Verify their own API key was not in the exposed repository
- Audit webhook delivery logs for the exposure window (Sep 9-20)
- Review shipment data for any unauthorised modifications