On July 13, 2025, a developer at the Department of Government Efficiency—DOGE—accidentally pushed a private xAI API key to GitHub. That key unlocked access to 52 unreleased LLMs, including Grok‑4‑0709, and remained active long after discovery. 

In this episode of Cyberside Chats, we examine how a single leaked credential became a national-level risk—and how it mirrors broader API key exposures at BeyondTrust and across GitHub. LMG Security’s Director of Penetration Testing, Tom Pohl, shares red team insights on how embedded secrets give attackers a foothold—and what CISOs must do now to reduce their exposure. 

Key Takeaways: 

 Monitor for exposure and misuse. Include secrets in IR playbooks—even when it’s third-party code. 

 Do they rotate keys? Use a secrets manager? How quickly can they revoke? 

 Look for credentials in cloud configs, automation, scripts, SaaS tools. 

Secrets can show up in unexpected places—firmware, config files, build artifacts. Your red team or vendor should actively hunt for exposed keys, hardcoded credentials, and reused certs across applications, infrastructure, and third-party tools. 

 Use GitGuardian, TruffleHog, and a secrets manager like AWS Secrets Manager or HashiCorp Vault. 

References: 

#DOGEleak #cybersecurity #cybersecurityawareness #ciso #infosec #itsecurity