Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All

Security researcher Bill Demirkapi unveiled at Defcon that he used VirusTotal's data to find more than 15,000 active developer secrets, along with 66,000 websites with dangling subdomain issues. The exposed secrets included usernames and passwords linked to Nebraska's Supreme Court IT systems, Stanford University Slack access details, and more than 1,000 OpenAI API keys. Demirkapi argues that unconventional large data sources can reveal such trivial vulnerabilities at scale. He said GitHub and Amazon Web Services did not provide him with a direct reporting channel, so he used GitHub's secret scanning by uploading the secrets to notes.