CrowdSec confirms source code leak from private repositories

On 16 September 2026, CrowdSec, a developer of network security solutions, received a report that source code had been leaked from its GitHub repository. The company's team verified the information and confirmed the incident, which had in fact taken place back in May 2026.

CrowdSec's source code falls into two parts. The public one is the Security Engine, free and open-source software that is open by design and therefore not part of the incident. The leak affected the private part: the code of the SaaS console, some cloud procedures for AWS, connectors and automation tools.

The company addressed the figure of 300 repositories that had made the headlines. It says the number is accurate if you add more than 130 public repositories to the private ones, but that it reflects the fragmentation of the code into modules rather than the real volume of data. CrowdSec also denied reports of some “internal development materials” — all of the code is already contained in those repositories anyway.

What was not affected

CrowdSec stresses that neither customer data, nor logins and passwords, nor the names of people or organizations were leaked. The company does not store personal data or customer logs at all, so the consequences are limited to CrowdSec itself. A search for tokens, credentials and other sensitive information that might let attackers go further has so far turned up nothing.

By the company's assessment, the stolen code does have value, but it is not capable of causing serious harm. CrowdSec's effectiveness rests on network effect and scale, which code alone cannot reproduce. The SaaS code was regularly audited, and over the past four months a significant portion of it has changed noticeably. Using the code outside of CrowdSec is also unlikely to work: it only functions with the company's own data and tools.

Attack vector

CrowdSec names the compromise of a TanStack component — the same one involved in the Mistral AI incident — as the most likely cause of the leak. According to the company, the library used in May had been fitted with a backdoor that extracted an API key with read access to the private codebase. The vulnerability could only be exploited during a brief window in May 2026.

After discovering the incident, the company immediately rotated all the necessary tokens and credentials to prevent a recurrence. The investigation is ongoing, and CrowdSec has promised to keep a close watch for any anomalous activity. The team extended special thanks to Fuites Infos — the researchers who reported the problem promptly and professionally.

Source: Hacker News