Toyota: an access key public on GitHub for five years
Part of an app’s source code, with a server key inside, sat in a public repository since 2017. Check your contractors too.
Toyota said this month that part of the source code for its T-Connect app had been in a public GitHub repository since December 2017, uploaded by a subcontractor. Inside was an access key to a data server. Close to 300,000 customer email addresses and customer numbers may have been exposed.
Five years. Nobody noticed until a researcher did.
Two lessons:
- Secrets don’t belong in code, not even in private repos, because private doesn’t stay private. Use environment variables or a secrets manager.
- Your contractors’ habits are your risk. Their repos, laptops and accounts touch your systems.
What to do:
- Scan your own repositories, including history, for keys. Free tools like Gitleaks do it in minutes.
- Search GitHub for your domain names, project names and internal hostnames. You might find code you didn’t know was public.
- Put rules for code and secrets into contractor agreements, and give contractors repos you own.
- Rotate keys on a schedule, so a forgotten leak has an expiry date.