The pricing engine and production keys left on an unencrypted personal drive

Credential accessOct. 16, 10:39 AM

2.3KSensitive

2.2KFile opens

8Launches

Why this was flagged

Production keys and full source left together, to a drive outside management, and the secrets file had never been read on this host.

Recommended actions

Confirm whether the drive left the premises
Rotate the release keys it carried
Preserve the workstation's USB and file-copy logs

Actor

eryanUser on: acme-mbp-eryan
Prior findings: 3

Baseline

cp, Finder, git: seen 14 of last 14 days
credentials.json: first seen 16m ago, new to this host

Open in Investigate

4 story events•2 chapters•3 flagged windows

read

bash-bash

cp14/14d

/opt/app/secrets/credentials.jsonNFirst seen 16m ago, new to this host

Finder14/14d

git14/14d

Story•5 nodes New•1 The finding · 04:46 to 04:48

1 2

04:31:50

What happened

1Copy

cp copied the whole pricing-engine working tree, source, its .git history, and the bundled /Volumes/.../release-keys onto a personal USB volume mounted at /Volumes/ERYAN/pricing-engine.

0 eventsAsk

2Ownership

The same drive already held /Volumes/ERYAN/Personal, which is what ties the volume to this account.

0 eventsAsk