Sourcegraph: Incident involving unauthorized admin access

Re:Sourcegraph: Incident involving unauthorized admin access by lopkeny12ko on Thursday August 31, 2023 @11:22AM (#37338630)

> On July 14, 2023 (2023-07-14 22:01:00 UTC) a Sourcegraph engineer accidentally committed a code change that contained an active site-admin access token. The site-admin access token had broad privileges to view and modify account information on Sourcegraph.com.

If any Sourcegraph leadership are on here, what is the current status of this developer's employment with Sourcegraph? More broadly, what accountability measures/disciplinary procedures are in place for this kind of gross negligence?

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by abtinf on Thursday August 31, 2023 @11:43AM (#37338997)

That would be a solid approach to ensure that the next incident is more severe and longer lasting.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by pc86 on Thursday August 31, 2023 @11:43AM (#37339007)

People make mistakes, get over it.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by lopkeny12ko on Thursday August 31, 2023 @12:06PM (#37339405)

So we are expected to just shrug off a leak of PII collected from self-hosted instances?

I would normally agree with you, but this was an egregious violation of trust.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by Operyl on Thursday August 31, 2023 @12:28PM (#37339787)

Realistically, you don't want to fire the person that makes this mistake. It pretty much is _never_ going to happen again for that employee, it's burned in their mind now.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by sqs on Thursday August 31, 2023 @03:02PM (#37342154)

The information that leaked was not collected from self-hosted instances. It was from Sourcegraph.com, which contains generally less sensitive information than self-hosted instances. See https://about.sourcegraph.com/blog/security-update-august-20... for full information.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by lopkeny12ko on Thursday August 31, 2023 @10:20PM (#37346039)

Do you have a response to the current top comment of this submission?

> Sourcegraph seems to have collected a bunch of these (now leaked) email addresses from signups on self-hosted instances.

> I remember being very surprised when I was signed up to their mailing list after I made an account on my self-hosted instance, and I'm not sure about the ethics (and legality) of collecting these in the first place.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by dcomas on Friday September 01, 2023 @01:18PM (#37353665)

Hey, Diego Comas here, Sourcegraph's Head of Security.

The only email addresses that were exposed were those of users who have accounts on Sourcegraph.com, not those of the installers or users of Sourcegraph self-hosted or cloud instances. Note that sometimes users have accounts on both platforms, though (e.g. for license key management). And as you mention, while we do collect the email addresses of the initial installers of self-hosted instances only, for security, product, and marketing updates per our TOS and privacy policy(https://about.sourcegraph.com/terms/privacy), those email addresses were not exposed since they are not stored on Sourcegraph.com.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by pc86 on Thursday August 31, 2023 @04:29PM (#37343281)

I think we're reading different articles, no employee leaked any PII. You're angry about something that didn't happen.

[ Parent | on HN ]

Re:Sourcegraph: Incident involving unauthorized admin access by evujumenuk on Thursday August 31, 2023 @11:54AM (#37339192)

Please do not post obvious rage bait. Doing so generally does not foster fruitful debate.

[ Parent | on HN ]