“Within minutes, we found a publicly accessible ClickHouse database linked to DeepSeek, completely open and unauthenticated, exposing sensitive data.”
DeepSeek left a ClickHouse database open to the internet with no password. It held over a million log lines, including plaintext chats and API keys. Anyone could run SQL against it from a browser. Wiz found it in minutes with basic recon.