28,000 Public .git Folders Left AWS Keys, Stripe Tokens, and HR Files Wide Open, Researchers Find
A large-scale internet scan uncovered 28,000 publicly accessible .git directories exposing hundreds of live cloud and payment credentials, along with sensitive employee records — a reminder that scrubbing...
Vercel Data Breach: ShinyHunters Exploit OAuth Supply Chain Attack to Steal Customer Credentials for $2M Sale
Vercel has confirmed a security breach originating through a compromised third-party AI tool (Context.ai), where attackers used stolen OAuth tokens to access internal systems and enumerate customer environment...
ClickUp’s Hardcoded API Key Has Silently Leaked 959 Corporate and Government Emails for 15 Months
A hardcoded API key in ClickUp's public JavaScript file exposed 959 corporate and government email addresses for over 15 months after responsible disclosure in January 2025. Affected organizations...
Vercel Confirms April 2026 Breach: ShinyHunters Accessed Source Code, API Keys, and Employee Data via AI Tool Compromise
Cloud development platform Vercel confirmed a security breach traced to a compromised employee account at third-party AI platform Context.ai. The ShinyHunters group claims to have stolen source code,...