A researcher finds 15K+ hardcoded secrets and 66K vulnerable websites, including details on accessing Stanford's Slack, by searching overlooked data sources
Security researcher Bill Demirkapi found more than 15,000 hardcoded secrets and 66,000 vulnerable websites—all by searching overlooked data sources. Forums: r/technews , r/cybersecurity , r/Nebraska , and r/technology Forums: r/technews : Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All r/cybersecurity : Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All r/Nebraska : Username and password details leaked for Nebraska's Supreme Court and its IT systems leaked at Defcon security conference r/technology : Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All
Context & Ripple Effects
This is another case of sensitive access data becoming discoverable through services and data sources that organizations may not treat as part of their attack surface. Related coverage shows the same failure mode at different layers: an exposed Elastic database containing credentials for major companies and, later, public tool pages that revealed tens of thousands of credentials.
The findings matter because they connect a large inventory of potentially weak websites with reusable secrets, rather than a single isolated leak. Stanford and Nebraska-related access details illustrate how public institutions and universities can be affected alongside corporate systems.
First-order effects
- Organizations whose secrets or sites were identified must validate the findings, revoke or rotate exposed credentials, and remediate the affected web properties; Stanford faces an immediate review of the reported Slack-access details.
- The approximately 66,000 identified websites become a prioritized remediation pool, while the disclosed Nebraska-related credentials require the relevant court and IT operators to assess exposure and replace access paths where needed.
Second-order effects
- Security teams are likely to expand secret-scanning and external attack-surface reviews beyond source repositories and conventional asset inventories to include the overlooked public sources used in the research.
- Credential and infrastructure exposure can raise incident-response workloads for organizations that lack clear ownership of public-facing data, especially where a discovered secret grants access to shared SaaS or administrative systems.
Third-order effects
- If repeated discoveries continue, public-data discovery will become a more formal security control: organizations will need to manage exposure across third-party tools, databases, and other internet-visible services, not just their own code and domains.
- The pattern favors security programs that treat secret rotation, asset ownership, and continuous external monitoring as ongoing operations; the extent of the shift will depend on how often disclosures translate into confirmed misuse.
The trend: This is one data point in the widening security trend of publicly reachable, overlooked services functioning as an unmonitored credential and attack-surface layer.