API Keys Security Breach

all things rabbit
1

I am sure someone just going to say don’t read anything on Reddit. However I saw a post on there that an API was exposed and the attached could download all a persons messages? I’m not sure how true any of it is : Reddit - Dive into anything

1 Like
2

Our official response as posted by @rabbit on Discord:

Today we were made aware of an alleged data breach. Our security team immediately began investigating it. As of right now, we are not aware of any customer data being leaked or any compromise to our systems.

If we learn of any other relevant information, we will provide an update once we have more details.

3 Likes
3

Any update here Simon?

4

Hi Dave,

I believe the investigation is close to conclusion and we are aiming to post more details next week. I will check up on this after the US holiday.

1 Like
5

Hi tech team,
without any polemical streak or intention to twist the knife in the wound, it would be interesting to know what measures you are taking regarding the very serious safety problems highlighted by the Rabbitude team.

Thanks

6

Gah - I don’t think we cross-posted this to the forums… sorry :frowning:
Here’s the page we were using to keep folks up to date during the event.

TLDR version:

  • Implemented a tool to prevent secrets from being stored in code in the future
  • Big pile of secret rotations happened
  • Small pile of secrets we missed the first time were moved OUT of code
  • Hiring a 3rd party to review/ensure that we didn’t miss anything :slight_smile:
3 Likes
7

Thank you for your quick reply @mattdomko

I was almost certain that you had already done something to address the issue, but searching here in the community I hadn’t found anything about it, so I took the liberty of asking for information about.

I’m sorry you were forced to fire your employee responsible for the code leak, but indeed he could have brought this up internally to resolve the problem.

Anyway, from this specific affair both you as technology company as well we as users have a lot to learn.

1 Like
8

Here’s a link to another thread with a TLDR + a link to the response doc :slight_smile:

https://forum.rabbitcommunity.tech/t/rabbitude-hardcoded-api-keys-issue/10554/2

2 Likes
9

I’ve merged the two topics - my apologies for not keeping the thread updated, I’ve been travelling over the holiday weekend! Thanks @mattdomko for stepping in :heart:

2 Likes