CircleCI
Held long-lived customer secrets until they leaked
OAuth tokens and API keys sat in CircleCI's systems until they leaked; customers already using short-lived credentials had much less to replace.
All case studies
Facebook
Secrets
6 case studies tagged secrets.
Codecov
A modified uploader lifted secrets out of customer pipelines
Attackers edited Codecov's bash uploader to exfiltrate environment variables from CI/CD pipelines, exposing thousands of customer secrets.
Mastra
Removed the npm token bypass after 116 packages were published
A token tied to a single compromised maintainer published 116 malicious packages in twenty-five minutes; the fix was deleting the bypass that let tokens publish at all.
Logged hundreds of millions of passwords in plaintext
Internal logging captured authentication payloads for debugging and kept the passwords readable, which is verbose observability turning into an incident.
Travis CI
Exposed the environment variables of thousands of projects
A configuration issue in the CI service leaked secrets that projects had stored there, across thousands of repositories.
Microsoft
Traced stolen OAuth tokens into mailboxes
In its Solorigate analysis, Microsoft showed OAuth tokens reaching email and other resources without needing passwords or MFA.