CrowdSec confirmed a source code leak from its CI/CD system

Company CrowdSec officially confirmed the fact of unauthorized access to its source code repository. The incident occurred in May 2026 as a result of the compromise of one of the components of the CI/CD infrastructure, which allowed attackers to access the project's internal files.

According to the security service's statement, the leak affected only the company's internal resources. Developers emphasize that customer data, user accounts, and access keys to services remained secure. External protection systems used by customers to filter traffic and prevent attacks were not compromised during this incident.

Technical analysis showed that the attack vector was aimed at automated build and deployment processes. Currently, the company is conducting an audit of all software supply chains and updating access protocols to CI/CD pipelines. Additional details of the community discussion of the incident are available on the Hacker News platform.

This case highlights the vulnerability of development automation tools to targeted attacks. CrowdSec continues its internal investigation to exclude the possibility of repeated access to the infrastructure through compromised components. The company has revised role-based access policies for all employees with the authority to change CI/CD configurations.