Twitch’s leak came from a server setting
Source code and creator payouts leaked after what Twitch calls a server configuration error. Misconfiguration is a breach too.
Earlier this month someone posted a 125 GB archive from Twitch: source code, internal tools and data on payouts to streamers. Twitch says it came from an error in a server configuration change that a third party then accessed.
No sophisticated exploit was described. A setting changed, and something became reachable that shouldn’t have.
Configuration is code now, and needs the same care:
- Review configuration changes like code changes, with a second pair of eyes.
- Scan cloud settings automatically for public storage, open ports and broad permissions.
- Keep secrets out of repositories, because source code leaks happen.
- Alert on large data transfers out of code and storage systems.
If your source code leaked tomorrow, what would an attacker find inside it? Find out first.