Leaked Home Depot credential exposed internal systems for a year

Depot exposed access to internal systems for a year, TechCrunch reports .

According to security researcher  Ben Zimmermann , a Depot employee published a private GitHub access token sometime in early 2024, likely by mistake.

Zimmerman told TechCrunch that when he tested the token, it granted access to private Depot repos on GitHub, with write permissions, as well as access to the company’s cloud infrastructure, including order fulfillment and inventory management systems.

Zimmerman, who told TechCrunch he has disclosed similar exposures to other companies, said he did not get a response to several emails he sent to Depot the leaked credential.

“ Depot is the only company that ignored me,” he said.

The leaked credential has since been removed from public view after TechCrunch contacted the company last week.