Official Statement: May 2026 Source Code Exposure

Published on: September 17, 2026
Reported on: September 16, 2026

CrowdSec recently became aware of a security incident involving the unauthorized exposure of our source code. This breach occurred back in May 2026.

Understanding the Scope of the Leak

To clarify the nature of the exposed data, it is important to distinguish between our different codebases. The total number of repositories involved was approximately 300, though this is a reflection of how our code is modularized rather than the sheer volume of data.

The number of private repositories can be calculated as: $\text{Total Repositories} (300) - \text{Public Repositories} (130+) = \approx 170 \text{ Private Repos}$

Impact Assessment

We want to be very clear about what was not compromised.

Security Guarantee: No client-side data, passwords, usernames, organization details, or PII (Personally Identifiable Information) were leaked. CrowdSec does not store client logs or PII, meaning the impact is strictly limited to our internal infrastructure.

Key Findings:

• Client Data $\rightarrow$ Not Leaked
• User Passwords $\rightarrow$ Not Leaked
• API Information: Only the token utilized by the CI/CD component was exposed.
• Lateral Movement: Our security team conducted a thorough hunt for credentials or tokens that could allow an attacker to move laterally through our systems; none were found.

While the private code has intrinsic value, it does not jeopardize the core of our business. Our strength lies in our network effect and scale, which cannot be replicated simply by possessing the source code. Furthermore, the leaked code is from May; since then, it has evolved significantly.

The Attack Vector

The evidence suggests that the breach was a result of the Tanstack compromise, a similar vector seen in the Mistral AI incident.

The compromised component was active in our environment during May 2026, allowing for the extraction of an API key with read-only permissions for our private codebase. This window of exploitability was brief.

Remediation Steps

We have taken the following actions to secure our environment:

• Immediate rotation of all compromised tokens and credentials.
• Comprehensive audit of the SaaS source code.
• Implementation of enhanced monitoring for abnormal activity.
• Verification that leaked code cannot be leveraged outside the CrowdSec ecosystem (as it requires internal tools/data).

# Example of the credential rotation process
$ crowdsec-admin rotate-all-tokens --env production
# Status: All CI/CD tokens successfully updated.

We extend our gratitude to Fuites Infos for their professional and timely reporting of this matter.

---

Other Recent Updates from CrowdSec

While we address this leak, we continue to roll out new tools to help our community:

1. Live Exploit Tracker: A new tool to identify which CVEs are being actively exploited in the wild using real-time IPs and IoCs.
2. CAPI Reliability: We have introduced rate limiting on the Central API (CAPI) to ensure consistent performance and prevent traffic spikes from misconfigured deployments.
3. CVE Explorer: A new resource designed to help organizations prioritize their vulnerability management.