# SmartThings App source code and keys leaked (May 2019 article) **URL:** \ **Category:** General Discussion\ **Tags:** security\ **Created:** [May 8, 2019, 1:39pm UTC](https://community.smartthings.com/t/smartthings-app-source-code-and-keys-leaked-may-2019-article/163204 "2019-05-08T13:39:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![joelw135](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/joelw135/32/70639_2.png) [@joelw135](https://community.smartthings.com/u/joelw135)\ **Post date:** [May 8, 2019, 1:39pm UTC](https://community.smartthings.com/t/smartthings-app-source-code-and-keys-leaked-may-2019-article/163204/1 "2019-05-08T13:39:40Z")
TechCrunch released this article. Not sure if it has been posted before. [https://techcrunch.com/2019/05/08/samsung-source-code-leak/?utm\_source=feedburner&utm\_medium=feed&utm\_campaign=Feed%3A+Techcrunch+(TechCrunch)](https://techcrunch.com/2019/05/08/samsung-source-code-leak/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29) ---
**Author:** ![JDRoberts](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/jdroberts/32/56577_2.png) [@JDRoberts](https://community.smartthings.com/u/JDRoberts)\ **Post date:** [May 8, 2019, 2:07pm UTC](https://community.smartthings.com/t/smartthings-app-source-code-and-keys-leaked-may-2019-article/163204/2 "2019-05-08T14:07:45Z")
Yikes! > one project contained credentials that allowed access to the entire AWS account that was being used, including over a hundred S3 storage buckets that contained logs and analytics data. > Hussein said Samsung took until April 30 to revoke the GitLab private keys. Samsung also declined to answer specific questions we had and provided no evidence that the Samsung-owned development environment was for testing. > . > Hussein is no stranger to reporting security vulnerabilities. He recently disclosed [a vulnerable back-end database at Blind](https://techcrunch.com/2018/12/20/blind-anonymous-app-data-exposure/), an anonymous social networking site popular among Silicon Valley employees — and found a server [leaking a rolling list of user passwords](https://www.vice.com/en_us/article/vbw8b9/elsevier-user-passwords-exposed-online) for scientific journal giant Elsevier. > . > Samsung’s data leak, he said, was his biggest find to date. > . > “I haven’t seen a company this big handle their infrastructure using weird practices like that,” he said. ---
**Author:** ![joelw135](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/joelw135/32/70639_2.png) [@joelw135](https://community.smartthings.com/u/joelw135)\ **Post date:** [May 8, 2019, 2:52pm UTC](https://community.smartthings.com/t/smartthings-app-source-code-and-keys-leaked-may-2019-article/163204/3 "2019-05-08T14:52:35Z")
> [@JDRoberts](#): > > Yikes! This is very worrisome to me! I installed a device called FING on my network and it warns of intrusion, but I don’t think this type of fear. ---
**Author:** ![sidjohn1](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/sidjohn1/32/16652_2.png) [@sidjohn1](https://community.smartthings.com/u/sidjohn1)\ **Post date:** [May 8, 2019, 2:59pm UTC](https://community.smartthings.com/t/smartthings-app-source-code-and-keys-leaked-may-2019-article/163204/4 "2019-05-08T14:59:27Z")
Yeah 20 days with full access to all or most of SmartThings, he must have opened a ticket with support. I bet it took 1 hr to fix it after support got it to the right person 🙂 . ---
**Author:** ![ero4444](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/ero4444/32/131402_2.png) [@ero4444](https://community.smartthings.com/u/ero4444)\ **Post date:** [May 8, 2019, 3:18pm UTC](https://community.smartthings.com/t/smartthings-app-source-code-and-keys-leaked-may-2019-article/163204/5 "2019-05-08T15:18:11Z")
another reason to update only rarely, after long marination ---
**Author:** ![Automated\_House](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/automated_house/32/99641_2.png) [@Automated\_House](https://community.smartthings.com/u/Automated_House)\ **Post date:** [May 8, 2019, 5:29pm UTC](https://community.smartthings.com/t/smartthings-app-source-code-and-keys-leaked-may-2019-article/163204/6 "2019-05-08T17:29:51Z")
Update rarely? Wouldn’t you want to update frequently so you got security patches in case some malicious code was inserted?