In early 2024, a significant security oversight at Home Depot occurred when an employee inadvertently published a private GitHub access token online. This incident left critical internal systems exposed for nearly a year. The leaked credential provided write permissions to hundreds of private source code repositories, as well as access to essential cloud infrastructure, which encompassed order fulfillment and inventory management systems.
The vulnerability was discovered by security researcher Ben Zimmermann in November, who promptly took steps to notify Home Depot of the exposure. Despite numerous attempts to reach out through email and LinkedIn, Zimmermann did not receive a response from the company. The situation remained unresolved until December when TechCrunch intervened by contacting Home Depot, leading to the eventual removal of the access token.
Home Depot’s lack of a formal vulnerability disclosure policy or bug bounty program may have contributed to the delayed response. As of now, it remains uncertain whether any unauthorized individuals accessed the systems during the year-long exposure period, highlighting the critical need for improved security protocols and responsive communication channels within the company.

Collections

A Home Depot employee accidentally published a private GitHub access token online in early 2024, exposing hundreds of private repositories and critical cloud infrastructure including order fulfillment and inventory systems for nearly a year. Security researcher Ben Zimmermann discovered the vulnerability in November but received no response from Home Depot despite multiple contact attempts. The token was only removed in December after TechCrunch contacted the company. The incident highlights the risks of inadequate security protocols and the absence of formal vulnerability disclosure programs.

Home Depot Credential Exposure Left Internal Systems Vulnerable for a Year