back
▲ 1 points

Has an API key issuer ever leaked customer API keys

by mathewpregasen·3y ago·2 comments·view on hn ↗
There’s been plenty of examples where API keys were leaked due to poor API key management, such as the Algolia or Mailgun report.

There are also examples where API user data was compromised due to a breached employee laptop.

However, I’m curious if an API developer / issuer ever has leaked their own customers’ API Keys, I.e. Stripe leaking Stripe API Keys.

2 comments
I know 3Commas and Cloudflare’s 2017 breach is sort-of this, but curious if a company have ever leaked API keys they create / manage and had to cycle every customer’s keys as a result
Think this happened to Heroku recently, not sure though.