this post was submitted on 19 May 2026
713 points (99.4% liked)

Technology

84798 readers
4679 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
713
‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub (gizmodo.com)
submitted 17 hours ago by throws_lemy@reddthat.com to c/technology@lemmy.world
92 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] demonsword@lemmy.world 187 points 17 hours ago* (last edited 17 hours ago) (3 children)

vibe code go brrrrrrr

EDIT: wow it's far worse, it was a single contractor that decided that his convenience was above any and all security recommendations ever written. Pure. Genius!

[–] wonderingwanderer@sopuli.xyz 15 points 12 hours ago

Contractor, eh?

How much do you wanna bet he has close personal ties to the trump family and zero cybersecurity experience?

[–] lIlIlIlIlIlIl@lemmy.world 60 points 16 hours ago (2 children)

Leaving passwords in plaintext has zero to do with “vibe coding”

[–] village604@adultswim.fan 71 points 16 hours ago (1 children)

It definitely can if an LLM did it.

[–] wucking_feardo@lemmy.world 4 points 9 hours ago

I agree and to expand the same point. Even if the llm didn't do it, it's entirely plausible the LLM recommended it and the dev just drank that coolaid

[–] demonsword@lemmy.world 24 points 16 hours ago

yeah, and this is why I edited my original post after reading the article.

[–] crusa187@lemmy.ml 38 points 16 hours ago (1 children)

Only the best people

[–] nymnympseudonym@piefed.social 3 points 9 hours ago

You know what's ironic? FedRAMP rules dictate that Thou Must Scan Thy Repos for Secrets (tokens, passwords, etc)

GitHub, ButrBucket, etc all have this out of the box for enterprise customers

https://support.atlassian.com/bitbucket-data-center/kb/how-to-scan-for-and-remove-passwords-or-secrets-in-bitbucket-server-repositories/