PingCAP is downplaying the breach
Commenters see the official statement's careful wording ('no commands run', 'systems reviewed') as lawyerly spin contradicted by a month-long exfiltration pipeline.
Audits and compliance badges are theatre
The recent NCC source-code assessment and a wall of SOC/ISO certifications did nothing; many say pentesting and compliance auditing are often pay-to-play box-ticking.
Opsec failures, not code, caused this
Credentials pasted into Jira and committed cloud keys show operational hygiene matters more than code safety; some argue it's mostly control-plane metadata rather than customer data.