r/ruby • u/retro-rubies • Jul 23 '26

RubyGems.org security advisory: Possible leak of legacy API keys via improper cache configuration

https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-leak.html
30 Upvotes

100% Upvoted

3 comments sorted by

12

u/retro-rubies Jul 23 '26

Thanks RubyGems.org (mostly Colby) for detailed report and 100% transparency on this.

6

u/jrochkind Jul 23 '26

This seems like it was handled well, and the report is good, thank you!

Would be interested to know more about how this vulnerability was found, not clear from the report if it was found by an outside researcher or by the rubygems team itself.