# Ben Zimmermann

> Security researcher specializing in identifying critical failures in large-scale systems. Awarded over $27,000 in bug bounties for securing critical infrastructure and the open web.

Ben is a California-based security researcher with a focus on secret scanning, infrastructure security, and vulnerability disclosure. His work has been featured in TechCrunch and NPR.

## Security Research
- Truffle Security - CDE Secret Exposure Research | Apr 2026 | Critical | Featured | https://trufflesecurity.com/blog/thousands-live-secrets-found-across-four-cloud-dev-environments: Scanned 22 million public projects across CodeSandbox, StackBlitz, CodePen, and JSFiddle, uncovering 8,792 verified live secrets.
- OpenAI - 3,342 Leaked API Keys | Mar 2026 | Critical | $500: Discovered 3,342 active OpenAI API keys leaked in public repositories. Reported to OpenAI Security, who confirmed and revoked the keys.
- Pump - Production Environment File Exposure | Mar 2026 | Critical | $2,000 | https://www.linkedin.com/posts/stuart-lundberg_pump-terms-conditions-activity-7441951300302479360-iJO8: Found a publicly exposed production environment file containing live AWS credentials with access to 57 S3 buckets, Auth0 management API tokens, and database credentials.
- TYPO3 - Slack Admin Token Exposure | Mar 2026 | Critical | $700: Found a leaked Slack token granting admin-level access to the TYPO3 workspace with 9,600+ members, including private channels and full message history.
- Algolia - Leaked Netlify Token Exposure | Mar 2026 | High | $700: Discovered a leaked Netlify token granting access to Algolia's Enterprise account, 44 sites, and DNS records for yarnpkg.com.
- Algolia DocSearch - 39 Admin Keys Exposed | Mar 2026 | Critical | Resolved | https://benzimmermann.dev/blog/algolia-docsearch-admin-keys: Scraped 15,000 documentation sites and found 39 Algolia admin API keys with full write access to search indexes for projects like Home Assistant and KEDA.
- Red Hat - SSH Key Exposure | Feb 2026 | Critical | Hall of Fame | https://access.redhat.com/articles/66234: Discovered a leaked SSH private key granting write access to eclipse-che/che, the upstream repository for Red Hat OpenShift Dev Spaces.
- TechCrunch - Home Depot Exposure | Dec 2025 | Critical | Featured | https://techcrunch.com/2025/12/12/home-depot-exposed-access-to-internal-systems-for-a-year-says-researcher/: A leaked GitHub token granted access to hundreds of private repositories, cloud infrastructure, and order fulfillment systems.
- GitHub - Critical Infrastructure Access | Nov 2025 | Critical | $20,000: Discovered a leaked OAuth token granting write access to 'github/github' and 74,000+ private repositories.
- TripAdvisor - Sensitive Data Exposure | Nov 2025 | High | $1,500: Identified a publicly exposed employee token with 'repo' and 'workflow' scopes, allowing access to source code and build pipelines.
- Vue.js - Admin API Key Exposure | Oct 2025 | Critical | Hall of Fame | https://github.com/vuejs/core/blob/main/SECURITY.md: Found a leaked Algolia Admin API key with write access to the official documentation search index.
- Chrome Extensions - AI Auth Bypass | Sep 2025 | High | Resolved: Reverse-engineered popular AI extensions to bypass client-side authentication, enabling free access to premium LLM APIs.
- Margelo - Exposed Credentials | Aug 2025 | Medium | Resolved: Discovered publicly exposed credentials that could compromise development infrastructure.
- Popsa - Security Misconfiguration | Jul 2025 | Medium | Resolved: Identified misconfigurations that could lead to unauthorized access to user data.
- NPR - Early Security Research | Apr 2018 | Low | Featured | https://www.npr.org/2018/06/18/620005246/a-guide-to-parental-controls-for-kids-tech-use: Discovered a Google Family Link security bypass at age 9, marking the beginning of my security research journey.

## Projects
- [awesome-secret-hunting](https://github.com/bzzimmy/awesome-secret-hunting): A curated list of tools, techniques, and resources for offensive secret scanning and credential discovery.

## Blog

### I Found 39 Algolia Admin Keys Exposed Across Open Source Documentation Sites
URL: https://benzimmermann.dev/blog/algolia-docsearch-admin-keys
Published: 2026-03-13
Reading Time: 3 min read
Tags: security-research, algolia, docsearch, api-keys, disclosure
Summary: A systematic audit of Algolia DocSearch found 39 admin API keys exposed across projects like Home Assistant, KEDA, and vcluster.

Last October I reported an exposed Algolia admin API key on vuejs.org. The key had full permissions: addObject, deleteObject, deleteIndex, editSettings, the works. Vue acknowledged it, added me to their [Security Hall of Fame](https://github.com/vuejs/core/blob/main/SECURITY.md), and rotated the key.

That should have been the end of it. But it got me thinking: if Vue.js had this problem, how many other DocSearch sites do too?

Turns out, a lot.

## How Algolia DocSearch works

Algolia's [DocSearch](https://docsearch.algolia.com/) is a free search service for open source docs. They crawl your site, index it, and give you an API key to embed in your frontend. That key is supposed to be search-only, but some ship with full admin permissions.

## What I found

Most keys came from frontend scraping. Algolia maintains a public (now archived) repo called [docsearch-configs](https://github.com/algolia/docsearch-configs) with a config for every site in the DocSearch program, over 3,500 of them. I used that as a starting target list and scraped roughly 15,000 documentation sites for embedded credentials. This catches keys that don't exist in any repo because they're injected at build time and only appear in the deployed site:

```python
APP_RE = re.compile(r'["\']([A-Z0-9]{10})["\']')
KEY_RE = re.compile(r'["\']([\da-f]{32})["\']')

def extract(text, app_ids, api_keys):
    if not ALGOLIA_RE.search(text):
        return
    for a in APP_RE.findall(text):
        if valid_app(a):
            app_ids.add(a)
    api_keys.update(KEY_RE.findall(text))
```

On top of that I ran GitHub code search to find keys in doc framework configs, then cloned and ran TruffleHog on 500+ documentation site repos to catch keys that had been committed and later removed.

35 of the 39 admin keys came from frontend scraping alone. The remaining 4 were found through git history. Every single one was active at the time of discovery.

The affected projects include some massive open source projects:

Home Assistant alone has 85,000 GitHub stars and millions of active installations. KEDA is a CNCF project used in production Kubernetes clusters. vcluster, also Kubernetes infrastructure, had the largest search index of any affected site at over 100,000 records.

## What these keys can do

Nearly all 39 keys share the same permission set: search, addObject, deleteObject, deleteIndex, editSettings, listIndexes, and browse. A few have even broader access including analytics, logs, and NLU capabilities.

In practical terms, anyone with one of these keys can:

- Add, modify, or delete any record in the search index
- Delete the entire index
- Change index settings and ranking configuration
- Browse and export all indexed content

Someone could poison a project's search results with malicious links, redirect users to phishing pages, or just nuke the entire index and wipe out search for the site completely.

## Disclosure

SUSE/Rancher acknowledged the report within two days and rotated the key. That key is now fully revoked. Home Assistant also responded and began remediation, though the original key remains active.

I compiled the full list of affected keys and emailed Algolia directly a few weeks ago. No response. As of today, all remaining keys are still active.

## The root cause

This isn't really about 39 individual misconfigurations. Algolia's DocSearch program provides search-only keys, but many sites [run their own crawler](https://docsearch.algolia.com/docs/legacy/run-your-own/) and end up using their write or admin key in the frontend config instead. Algolia's own docs warn against this, but it clearly happens at scale.

The fix is straightforward: if you're running DocSearch, check what key is in your frontend config and make sure it's search-only. If I found 39 admin keys with a few scripts, the real number is almost certainly higher.

### How a Single Leaked Token Exposed Home Depot's Internal Infrastructure for a Year
URL: https://benzimmermann.dev/blog/home-depot-token-exposure
Published: 2026-01-16
Reading Time: 3 min read
Tags: security-research, disclosure, github, token-exposure
Summary: A leaked GitHub token granted access to 664 internal repositories for nearly a year. Home Depot never responded.

In early November 2025, I discovered a GitHub personal access token belonging to a Home Depot employee. The token had been publicly exposed since early 2024, and it granted far more access than "hundreds of private repositories."

This is the technical breakdown of what that access actually looked like.

Admin access means full control: delete repositories, modify branch protection, add collaborators, access secrets. Push access means the ability to modify code directly. This wasn't read-only access to archived projects, it was write access to production systems.

## What Was Exposed

The accessible repositories included critical internal systems:

**Authentication & User Access**
- `hdw-login-manager` - Core authentication system
- `hdw-user-access-config-core` - User access control
- `hdw-user-access-cron-job` - Scheduled access management

**Order Fulfillment**
- `hdw-fulfillment-core` - Order fulfillment logic
- `hdw-store-order-interface` - Store order processing
- `hdw-order-update-script` - Order management tooling

**Infrastructure & Configuration**
- `hdy-gcp-config-*` - Google Cloud Platform configuration
- `hdy-cockroachdb-config-*` - CockroachDB database configuration
- `scsre-infra-*` - Supply chain SRE infrastructure (40+ repos)

**Secrets Management**
- `cf-vault` - HashiCorp Vault secrets management
- `ci-cd-vault-unsealer` - Vault unsealing for CI/CD
- `artifact-registry-token` - Artifact registry authentication
- `java-trusted-certificates` - Certificate trust management

I attempted to report this responsibly:

- **Early November 2025** - Discovered the exposed token
- **Multiple emails sent** - No response from Home Depot security
- **LinkedIn message to CISO** - No response
- **December 3, 2025** - Contacted TechCrunch after exhausting options
- **December 9, 2025** - Token revoked (only after TechCrunch reached out)

Home Depot has no vulnerability disclosure program and no public way to report security issues. Their spokesperson acknowledged TechCrunch's email but did not respond to questions about whether anyone else accessed their systems during the year-long exposure.

During the approximately one-year exposure window:

- **460 repositories** (69%) had commits during the exposure period
- **232 repositories** were pushed to in the last 90 days

Many systems were actively developed throughout:

| Repository | Last Push | Category |
|------------|-----------|----------|
| `hdw-login-manager` | Nov 24, 2025 | Authentication |
| `hdw-fulfillment-core` | Nov 25, 2025 | Order Fulfillment |
| `scsre-infra-flesh` | Nov 25, 2025 | Infrastructure |
| `hdw-config-c1` | Nov 25, 2025 | Configuration |

## What Should Have Happened

1. **Vulnerability Disclosure Program** - A public security.txt or VDP would have allowed immediate reporting
2. **Don't Ignore Researchers** - Any acknowledgment would have been better than none
3. **Least Privilege** - A single employee token should not have admin access to 64 repositories

## Links
- GitHub: https://github.com/bzzimmy
- LinkedIn: https://www.linkedin.com/in/benzimm/
- HackerOne: https://hackerone.com/kernelrocks/
- Email: mailto:kernelrocks@proton.me