“Our internal control systems, including automated code analysis, failed to catch the access token being committed to the repository.”
A Sourcegraph engineer committed a live site-admin token on July 14. It sat in the open for six weeks until someone used it to hand out boosted rate limits through a proxy app, and that app drew close to 2 million views. Sourcegraph sells a tool for searching code. It never searched its own commits.