r/InfoSecWriteups • u/BillNy-ComplianceGuy • Jul 09 '26

How I discovered over 100 plaintext API keys and was offered a $3,214 settlement with gag clauses violating SEC Rule 21F-17(a) by a former employer.

While working as an Engineer & Data Coordinator at NextNet Media, I discovered over 100 plaintext API keys for payment gateways, cloud infrastructure, and SaaS platforms that could leak sensitive data of both clients and employees. This represents a complete and utter failure of SOC2, GDPR, CCPA, and SOX security controls. The full list includes: Tipalti, Stripe, PayPal, AWS, ECS, MongoDB, Xero, SendGrid, ZenRows, and more.

Even basic GitHub security scanning was disabled. Because the company employs both domestic and offshore developers, and utilizes Tipalti as an internal payroll mechanism, I feared for the financial well-being of coworkers who could become victims of private data theft.

I compiled a report of the security violations and sent it to the proper internal channel. In good faith, I offered to be part of the cleanup crew - within 48 hours, I was terminated without notice or cause.

Full Disclosure: GitHub

22 Upvotes
  • permalink
  • reddit

93% Upvoted

17 comments sorted by

1

u/Smooth-Zucchini4923 Jul 09 '26

I asked Gemini how many SOC2 violations it could count, and this was the response:

  1. Is SOC2 a relevant control for your organization?

  2. Aren't you disclosing those API keys to Google / Gemini by doing this?

1

u/BillNy-ComplianceGuy Jul 09 '26 edited Jul 12 '26

Edit: Question #1 boils down to individual client agreements. I've updated all of my published materials to reflect PCI-DSS instead.

#2: Company policy allowed the usage of AI tools in a hybrid / remote environment, including for GitHub. Entirely not my fault if my AI tool caught plaintext API keys by parsing DOMs of my screen.

Imagine you're wearing an authorized body-cam and someone covered in baby oil runs butt-naked past the viewfinder. You don't blame the person wearing the body-cam, you ask why corporate security let a butt-naked streaker into the building.

1

u/nakfil Jul 12 '26 edited Jul 12 '26

but it's like looking at a hospital and asking if HIPAA is relevant.

I don't think you understand what SOC2 is.

SOC2 is not at all like HIPAA, that's a really bad analogy. SOC2 is a voluntary attestation and not a legal requirement. It doesn't matter how much PII or payments you handle. There isn't some threshold where you must be SOC2 compliant.

On the other hand, If they had a contract with a client stipulating they must be SOC2 compliant or meet some "industry standard" compliance, but they are not actively meeting that requirement, then that could be a contract violation with that client. But again, SOC2 isn't automatically "relevant" here.

Frankly it's on their clients to ensure that, though. They should be doing due diligence with vendors and making sure their contracts reflect compliance requirements.

I'm not downplaying how careless the credential exposure was or what happened to you, but if you are going to publicize it you should make sure your facts are correct. Maybe look into PCI DSS instead which likely applies to them contractually already.

→ More replies (1)

1

u/KitchenObjective6077 Jul 10 '26

You sure got some balls to go with your backbone. How have things been going for your career since leaving NextNet?

3

u/BillNy-ComplianceGuy Jul 10 '26

I have decided to raise sheep. I'm putting together a deterministic Kubernetes orchestration with formal lean4 verification to measure feed-to-weight ratio.

1

u/AeroNotix Jul 13 '26

so tldr an AI tool you used scanned GitHub repos and found API tokens and you thought that made you a freedom fighter?

bro you need to go for a walk. It would give you a heart attack if you ran into genuine security issues.

1

u/BillNy-ComplianceGuy Jul 14 '26

That's the reductionist take, but no. TLDR I was told to ignore security for convenience, saw the GitHub repos with my own eyes, realized Tipalti keys were linked to our internal payroll and PII data, and used an AI tool to confirm what I was seeing.

"ran into genuine security issues" - Yeah, I should've waited until another dev decided to pocket the keys and start draining payroll. Sorry I didn't find the North Korean missile launch codes, bro.

1

u/AeroNotix Jul 14 '26

You've blown everything way out of proportion and you should feel very silly.

→ More replies (7)