Finding 01 · IllustrativeCritical
Public staging bucket and a leaked API key give read access to production customer data
OWASP A02:2025 Security Misconfiguration · A01:2025 Broken Access Control · MITRE ATT&CK T1552 Unsecured Credentials
What we found
External discovery found a storage bucket left public on a forgotten staging subdomain. It held a build artifact with a hard-coded API key. The key was still valid in production and was not scoped, so it could list and read customer records through the public API. Separate tools had flagged each piece as medium; none connected them.
Impact
Anyone who found the subdomain could read production customer data without an account.
How to fix it
Remove public access to the bucket and rotate the key. Scope API keys per environment with least privilege, add secret scanning to the build pipeline, and bring the staging subdomain into the asset inventory.
