💨 Abstract

A security researcher discovered that Home Depot had exposed access to its internal systems for a year after an employee accidentally published a private access token online. The token granted access to hundreds of private source code repositories and critical systems, including cloud infrastructure and order management. The researcher attempted to notify Home Depot but was ignored until TechCrunch intervened, leading to the exposure being fixed. Home Depot lacks a formal vulnerability disclosure program, complicating responsible disclosure efforts.

Courtesy: Zack Whittaker