how it happened
- whoanyone lookingpublic repository
- the gapaccess key in codenever rotated
- the result296,019 customers~5 years exposed
what everyone assumed
A credential left in old code feels like a credential that expires on its own. The thinking is that keys rotate, servers move, projects get rebuilt, and whatever was hardcoded during development becomes inert long before anyone could find it. It is a reasonable way to think, because the alternative, that a string typed into a file in 2017 is still a live door in 2022, sounds like something that would have been caught.
what happened
The key did not go stale. From December 2017 forward, the repository was reachable by anyone who looked, and the access key inside it still authenticated to the data server it was written for. Nothing rotated it, because nobody knew it was there. The window ran across most of five years while the app grew, customers registered, and the data server filled up with the addresses and management numbers of people who had linked their cars to their phones. A hardcoded secret does not age into safety; it waits at the same value it was committed with.
step by step
- December 2017an access key is committed to a public repoIt still works on the data server.the assumption breaks here
- nobody rotates it for five yearsNobody knows it is there.
- 15-17 September 2022the repo is closed and keys changed
- 296,019 customers' details were reachableAccess by a third party can be neither confirmed nor ruled out.
how it surfaced
Toyota found the public repository and restricted access to it on September 15, 2022, then changed the data server’s keys on September 17. The disclosure put a number on the exposure window: the details of 296,019 customers had been reachable between December 2017 and September 2022. Toyota’s own review could not confirm that a third party had accessed the data, and could not rule it out either. The assumption retired itself in a single sentence of the notice, the one admitting that the key had been valid the entire time.
A secret committed to a repository stays exactly as usable as the day it was written, for as long as the repository is reachable and the key is not rotated.
Time does not defuse it; only revocation does.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe key stays valid for years while your customer database grows.what it costs youYou cannot rule out that someone used it, and you have to tell every customer.
- or it goes like thisit happenedCash App / Block, 2022howThe person logs back in from home, weeks after leaving.what leavescustomer lists and reportswho ends up with itthe former employee and whoever they work for next
- or it goes like thisit happenedColonial Pipeline, 2021howThe forgotten account's password turns up in a breach dump.what leavesa working way into the networkwho ends up with ita ransomware crew
sources
your turn
what you can do about it
this week
Run a secret scan across your repositories and their history, not just the current tip, and rotate anything that resolves to a live credential.
Your repositories almost certainly contain a key or two that someone added to make a build work and meant to remove later. The quiet-months question is whether any of them still authenticate to something, and whether any repository that holds one has ever been public, even briefly. The keys that hurt are the ones that were assumed dead.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →