this post was submitted on 19 May 2026
593 points (99.3% liked)

Technology

84793 readers
3924 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
593
‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub (gizmodo.com)
submitted 23 hours ago by throws_lemy@reddthat.com to c/technology@lemmy.world
98 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] demonsword@lemmy.world 170 points 23 hours ago* (last edited 23 hours ago) (3 children)

vibe code go brrrrrrr

EDIT: wow it's far worse, it was a single contractor that decided that his convenience was above any and all security recommendations ever written. Pure. Genius!

[–] lIlIlIlIlIlIl@lemmy.world 58 points 23 hours ago (2 children)

Leaving passwords in plaintext has zero to do with “vibe coding”

[–] village604@adultswim.fan 65 points 23 hours ago (1 children)

It definitely can if an LLM did it.

[–] wucking_feardo@lemmy.world 3 points 15 hours ago

I agree and to expand the same point. Even if the llm didn't do it, it's entirely plausible the LLM recommended it and the dev just drank that coolaid

[–] demonsword@lemmy.world 22 points 23 hours ago

yeah, and this is why I edited my original post after reading the article.

[–] crusa187@lemmy.ml 39 points 23 hours ago (1 children)

Only the best people

[–] nymnympseudonym@piefed.social 4 points 15 hours ago

You know what's ironic? FedRAMP rules dictate that Thou Must Scan Thy Repos for Secrets (tokens, passwords, etc)

GitHub, ButrBucket, etc all have this out of the box for enterprise customers

https://support.atlassian.com/bitbucket-data-center/kb/how-to-scan-for-and-remove-passwords-or-secrets-in-bitbucket-server-repositories/

[–] wonderingwanderer@sopuli.xyz 10 points 18 hours ago

Contractor, eh?

How much do you wanna bet he has close personal ties to the trump family and zero cybersecurity experience?