Fast Facts

• Over 80,000 code snippets with sensitive data found exposed via online code formatting tools.
• Leaked information includes bank credentials, private keys, and government scripts.
• Data was accessible through “Recent Links” features with no authentication required.
• Attackers can easily scrape these links using simple automated tools.
• Some leaks involved critical infrastructure, major financial exchanges, and cybersecurity firms.

The Accidental Leak: A Digital Pandora’s Box

Picture this: a developer, rushing to fix a bug, pastes a jumble of code into an online formatter. With a click, the code gets beautified - and, with another click to “save” for sharing, it’s quietly published to the world. Multiply this by tens of thousands, and you have the digital equivalent of leaving keys to the kingdom on a public bench.

This is exactly what security researchers at WatchTowr stumbled upon when they investigated JSONFormatter and CodeBeautify - two popular online tools used to tidy up code. Their “Recent Links” feature, designed for convenience, turned into a treasure trove for anyone with a web browser and curiosity. In total, more than 80,000 user pastes, spanning sensitive sectors like banking, government, and tech, lay exposed for years - unprotected, unmonitored, and shockingly easy to find.

Secrets Hiding in Plain Sight

The technical flaw was simple: when users saved their code snippets, the tools generated predictable, public links. These links were indexed under “Recent Links” pages, freely accessible without any barrier. Automated web crawlers could scoop up the URLs en masse, and anyone could fetch the raw data using a basic API call. The contents? Active Directory credentials, cloud platform passwords, database keys, and even production-level secrets from major financial institutions and government agencies.

Among the findings: detailed scripts from government IT teams, configuration files from tech companies, credentials for a major international stock exchange, and even secrets from a leading cybersecurity firm. In one case, a managed security provider leaked not only its own sensitive data, but also the credentials of its largest banking client - effectively handing over the front door keys to both house and vault.

History Repeats: A Familiar Digital Blind Spot

This isn’t the first time accidental leaks have haunted the tech world. In 2017, researchers found thousands of private keys and credentials on public GitHub repositories due to careless copy-pasting. More recently, misconfigured cloud storage buckets have led to similar exposures across healthcare, retail, and government. The root cause is often the same: convenience features meant to help developers end up bypassing basic security hygiene.

What makes this case more alarming is the ease with which threat actors can exploit it. WatchTowr planted fake credentials as “honeypots” and found them being tested by unknown parties within days - even after the original links had expired, suggesting persistent, automated scanning by attackers. With such low-hanging fruit, it’s not a question of if, but how quickly, malicious actors will take advantage.

Beyond the Pastebin: The Market and Geopolitical Stakes

In an era where cyber espionage and ransomware are state-level threats, these leaks have implications far beyond individual organizations. Exposed credentials can enable everything from targeted phishing to infrastructure sabotage, especially when attackers gain insight into internal configurations and cloud environments. The fact that banks, government agencies, and critical infrastructure providers are among the victims only raises the stakes. As the global digital supply chain becomes ever more interconnected, a single careless paste can ripple across continents.

WIKICROOK

• JSON: JSON is a straightforward text format for storing and sharing data, easily readable by both humans and computers, widely used in web technologies.
• API: An API is a set of rules that lets software applications communicate, enabling developers to access services like AI models over the internet.
• Credential: A credential is information like a username or password used to confirm your identity when accessing online accounts or secure systems.
• Honeypot: A honeypot is a fake system set up to attract cyber attackers, enabling organizations to study attack methods without endangering real assets.
• Web Crawler: A web crawler is an automated tool that scans and collects data from web pages, used by search engines and sometimes by hackers for various purposes.