trufflesecurity.com on Hacker News
11 stories on the front page, newest first. Scroll down to watch the site change over time.
Google API keys weren't secrets, but then Gemini changed the rules(trufflesecurity.com)
1206 points by hiisthisthingon | 288 comments
Truffle Security blog post explaining that public Google API keys, long deemed non-secret, can now access Gemini and private data, based on scans of exposed keys.
I found a backdoor into my bed(trufflesecurity.com)
855 points by riverdroid | 345 comments
Truffle Security blog post describing a backdoor found in the Eight Sleep smart bed that allowed remote access, and how the authors removed it.
Google’s OAuth login doesn’t protect against purchasing a failed startup domain(trufflesecurity.com)
466 points by simiones | 255 comments
Truffle Security blog post describing how buying expired domains of failed startups lets attackers log into former employees' accounts via Google OAuth.
Anyone can access deleted and private repository data on GitHub(trufflesecurity.com)
1823 points by __0x1__ | 341 comments
Truffle Security blog post explaining how data from deleted forks, deleted repositories, and private repositories on GitHub can remain accessible to anyone.
