this post was submitted on 19 May 2026
618 points (99.4% liked)

Technology

86814 readers
4990 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
618
‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub (gizmodo.com)
submitted 2 months ago by throws_lemy@reddthat.com to c/technology@lemmy.world
100 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] demonsword@lemmy.world 180 points 2 months ago* (last edited 2 months ago) (3 children)

vibe code go brrrrrrr

EDIT: wow it's far worse, it was a single contractor that decided that his convenience was above any and all security recommendations ever written. Pure. Genius!

[–] lIlIlIlIlIlIl@lemmy.world 62 points 2 months ago (2 children)

Leaving passwords in plaintext has zero to do with “vibe coding”

[–] village604@adultswim.fan 69 points 2 months ago (1 children)

It definitely can if an LLM did it.

[–] wucking_feardo@lemmy.world 5 points 2 months ago

I agree and to expand the same point. Even if the llm didn't do it, it's entirely plausible the LLM recommended it and the dev just drank that coolaid

[–] demonsword@lemmy.world 22 points 2 months ago

yeah, and this is why I edited my original post after reading the article.

[–] crusa187@lemmy.ml 42 points 2 months ago (1 children)

Only the best people

[–] nymnympseudonym@piefed.social 6 points 2 months ago

You know what's ironic? FedRAMP rules dictate that Thou Must Scan Thy Repos for Secrets (tokens, passwords, etc)

GitHub, ButrBucket, etc all have this out of the box for enterprise customers

https://support.atlassian.com/bitbucket-data-center/kb/how-to-scan-for-and-remove-passwords-or-secrets-in-bitbucket-server-repositories/

[–] wonderingwanderer@sopuli.xyz 10 points 2 months ago

Contractor, eh?

How much do you wanna bet he has close personal ties to the trump family and zero cybersecurity experience?