GoKawiilCrowdSec confirms private GitHub repositories leaked, no customer data exposed
CrowdSec disclosed that a leak of its private source code repositories occurred in May 2026 and was reported to the company on September 16. The exposed material includes SaaS console code, AWS routines, connectors, and CI/CD tokens, but excludes CrowdSec's public Security Engine software. The company found no evidence of leaked credentials, customer data, or login information, and believes the Tanstack supply-chain compromise was the likely entry point.
GoKawiil's interpretation of the reporting above, not reported fact.
Even security vendors face supply-chain risk through third-party dependencies like Tanstack, echoing similar incidents affecting companies like Mistral AI. While CrowdSec argues the leaked code alone can't replicate its network-effect advantage, the episode highlights how CI/CD pipeline compromises can expose private repositories months before detection, raising questions about monitoring gaps across the industry.
- The breach originated in May 2026 but wasn't detected until September, a four-month gap.
- No client data, credentials, or PII were compromised, limiting the impact to CrowdSec itself.
- The Tanstack compromise is suspected as the attack vector, similar to a prior Mistral AI incident.
Source: crowdsec.net, 2026-09-17
Published there as: “CrowdSec Source Code Leak”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.