Investigations & Forensics

The Security Researcher Who Found Our Keys in a Public Repo

An email arrived from Amal Jacob. He had found an exposed ClickUp API key in a public GitHub repo. What followed was a multi-hour credential rotation, 15 repos made private, and one very uncomfortable discovery about how many secrets were just sitting out there.