--- title: ChainDrop follow-up: 9,300 live AWS keys exposed, GitHub... description: Truffle Security found over 9,300 publicly exposed AWS access keys that are still active, including 526 root keys and 242 with AdministratorAccess — most... canonical: https://daily.dev/posts/chaindrop-follow-up-9-300-live-aws-keys-exposed-github-oauth-gets-expiring-tokens-63f2rgiyz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ChainDrop follow-up: 9,300 live AWS keys exposed, GitHub OAuth gets expiring tokens | daily.dev og:description: Truffle Security found over 9,300 publicly exposed AWS access keys that are still active, including 526 root keys and 242 with AdministratorAccess — most... og:url: https://daily.dev/posts/chaindrop-follow-up-9-300-live-aws-keys-exposed-github-oauth-gets-expiring-tokens-63f2rgiyz og:image: https://api.daily.dev/og/posts/63f2RGiYZ.png og:image:alt: ChainDrop follow-up: 9,300 live AWS keys exposed, GitHub OAuth gets expiring tokens og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ChainDrop follow-up: 9,300 live AWS keys exposed, GitHub OAuth gets expiring tokens **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary Truffle Security found over 9,300 publicly exposed AWS access keys that are still active, including 526 root keys and 242 with AdministratorAccess — most scraped from Hugging Face. GitHub pushed OAuth security updates adding expiring 8-hour access tokens and wildcard redirect URI controls, with the legacy single-URI wildcard behavior now visible and configurable. Netflix published a detailed writeup on running two Flink autoscalers across 30,000 jobs, with one team cutting compute costs 58% ($1.1M/year) after switching to the OSS autoscaler. AWS Glue 6.0 landed with a 30% price cut and full Apache Iceberg v3 support on Spark 4.1. ## Content **TLDR:** Truffle Security found over 9,300 publicly exposed AWS access keys that are still active, including 526 root keys and 242 with AdministratorAccess — most scraped from Hugging Face. GitHub pushed OAuth security updates adding expiring 8-hour access tokens and wildcard redirect URI controls, with the legacy single-URI wildcard behavior now visible and configurable. Netflix published a detailed writeup on running two Flink autoscalers across 30,000 jobs, with one team cutting compute costs 58% ($1.1M/year) after switching to the OSS autoscaler. AWS Glue 6.0 landed with a 30% price cut and full Apache Iceberg v3 support on Spark 4.1. --- ## 9,300 live AWS keys exposed publicly, 526 are root keys Truffle Security scraped code repos, Docker images, CI logs, and datasets and found 9,300+ AWS access keys that remain active — spanning August 2022 to August 2026. Of the 817 belonging to companies, 526 are root keys and 242 are tied to AdministratorAccess IAM users. Hugging Face alone accounts for 8,482 unique exposures. Median key age is around five years, and most accounts had no budget alerts configured to catch abuse like cryptomining. The immediate actions: delete root keys, rotate anything that's ever touched a public surface, and treat any committed credential as already compromised. [Read more](https://daily.dev/posts/RtjxUag2x) ## GitHub OAuth apps get expiring tokens and configurable redirect URI wildcards GitHub OAuth apps can now opt into 8-hour access tokens with 6-month refresh tokens via the offline_access scope or a forced registration setting — new apps get short-lived tokens by default. The redirect URI limit jumped from 1 to 10, and wildcard matching is now configurable for both OAuth and GitHub Apps. The part worth auditing immediately: apps with a single redirect URI had wildcard matching silently enabled as legacy behavior. That setting is now visible in app settings — turn it off if you don't need it. All of this ships to GitHub Enterprise Server 3.23. [Read more](https://daily.dev/posts/k1OU4ItBZ) ## Netflix runs 30,000 Flink jobs across two autoscalers, one team saves $1.1M/year Netflix has been running its homegrown autoscaler alongside the Apache Flink OSS autoscaler, and the comparison is instructive. The in-house scaler cuts resource usage 25-45% but can't handle multi-operator stateful DAGs. The OSS autoscaler reasons from inside the job using per-operator processing rates, but required significant Netflix-specific engineering: a Temporal-based workflow-per-job architecture, JobManager metric fixes for jobs up to 3,000 subtasks, and sink-backpressure detection. One team that migrated cut annualized Flink compute costs 58%, saving about $1.1M/year. Netflix now runs target utilization at 0.45 instead of the community default of 0.7 for stability. [Read more](https://daily.dev/posts/CSTVuG6m2) ## AWS Glue 6.0: 30% price cut, Iceberg v3, Spark 4.1 AWS Glue 6.0 is generally available with a 30% price reduction and full Apache Iceberg v3 support built on Iceberg 1.11.0 and Spark 4.1. The headline Iceberg v3 additions are the VARIANT data type with automatic shredding for semi-structured data, deletion vectors for row-level updates, and geometry/geography types. The runtime stack moves to Python 3.12/3.13 and Scala 2.13. No API changes required — existing jobs select version 6.0 via --glue-version or use the Spark Upgrade Agent for auto-migration. [Read more](https://daily.dev/feed-by-ids?id=Dkp07ZvdA&id=lEaQ7LqLv) --- ## Also notable - **Bun 1.4 rewrites from Zig to Rust: 5.1ms startup, 13-48% less peak memory:** Bun 1.4, the first version rewritten from Zig to Rust (780,000 lines ported by 64 concurrent Claude agents over 11 days), cuts startup time from 10.9ms to 5.1ms, reduces peak memory 13-48%, and drops idle CPU 5x; breaking changes include stricter TLS verification, YAML 1.2 compliance, and no auto-loading of .env files when invoked as node. [Read more](https://daily.dev/posts/6HNowCHY6) - **Cloudflare found and fixed a working remote Spectre attack against Workers:** Cloudflare discovered a working remote Spectre side-channel attack against its V8-isolate-based Workers platform, patched it, and confirmed no exploitation in the wild before the fix. [Read more](https://daily.dev/posts/kmDfUFVoG) - **PostgreSQL connection pool benchmark: 48 connections beat 400 on a 4-core instance:** A pgbench sweep on PostgreSQL 17.11 (4 cores) shows throughput peaking at 48 connections (18,039 tps) and dropping 37% by 400 connections while latency multiplies 13x, with Universal Scalability Law fit predicting an optimum of 45.1 — the diagnostic to watch is queue depth (cl_waiting in PgBouncer), not raw connection count. [Read more](https://daily.dev/feed-by-ids?id=mVlgrYPkO&id=F0OqiZyNP) - **Dash0 acquires Polar Signals, adds GPU profiling down to individual CUDA kernels:** Dash0 acquired Berlin-based Polar Signals for $110M-backed continuous profiling, bringing NVIDIA CUDA kernel-level GPU visibility, the Parca open source project, and the Great Lakes storage engine Dash0 plans to eventually use to replace ClickHouse. [Read more](https://daily.dev/posts/hlVy4k5hL) - **S3-compatible neoclouds have meaningful security gaps versus AWS S3:** A Wiz report on six neoclouds (Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, DigitalOcean) found that Block Public Access semantics, IAM models, and secret-scanning support diverge significantly from AWS S3 — on one unnamed provider, running delete-bucket-policy reportedly deleted the entire bucket. [Read more](https://daily.dev/posts/mOR31MUJE) ## Similar posts on daily.dev - [Over 543,000 valid credentials exposed in public GitHub repositories](https://daily.dev/posts/over-543-000-valid-credentials-exposed-in-public-github-repositories-fblhmhuem) · BleepingComputer · 1 upvotes · 0 comments - [Security boffins harvest bumper crop of API keys from web](https://daily.dev/posts/security-boffins-harvest-bumper-crop-of-api-keys-from-web-56ku6ambh) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#github](https://daily.dev/tags/github), [#apache-flink](https://daily.dev/tags/apache-flink) [View this post on daily.dev](https://daily.dev/posts/chaindrop-follow-up-9-300-live-aws-keys-exposed-github-oauth-gets-expiring-tokens-63f2rgiyz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/chaindrop-follow-up-9-300-live-aws-keys-exposed-github-oauth-gets-expiring-tokens-63f2rgiyz","headline":"ChainDrop follow-up: 9,300 live AWS keys exposed, GitHub OAuth gets expiring tokens","text":"Truffle Security found over 9,300 publicly exposed AWS access keys that are still active, including 526 root keys and 242 with AdministratorAccess — most scraped from Hugging Face. GitHub pushed OAuth security updates adding expiring 8-hour access tokens and wildcard redirect URI controls, with the legacy single-URI wildcard behavior now visible and configurable. Netflix published a detailed writeup on running two Flink autoscalers across 30,000 jobs, with one team cutting compute costs 58% ($1.1M/year) after switching to the OSS autoscaler. AWS Glue 6.0 landed with a 30% price cut and full Apache Iceberg v3 support on Spark 4.1.","url":"https://daily.dev/posts/chaindrop-follow-up-9-300-live-aws-keys-exposed-github-oauth-gets-expiring-tokens-63f2rgiyz","datePublished":"2026-08-22T04:18:06.143Z","dateModified":"2026-08-22T04:18:27.912Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"ChainDrop follow-up: 9,300 live AWS keys exposed, GitHub OAuth gets expiring tokens"}]} ```