[HN Gopher] Home Depot GitHub token exposed for a year, granted ...
___________________________________________________________________
Home Depot GitHub token exposed for a year, granted access to
internal systems
Author : kernelrocks
Score : 146 points
Date : 2025-12-12 18:23 UTC (4 hours ago)
(HTM) web link (techcrunch.com)
(TXT) w3m dump (techcrunch.com)
| indigodaddy wrote:
| Wow, the non-response/communication at any time by Home Depot to
| all parties involved in trying to help them, is staggering.
| el_benhameen wrote:
| If you've ever tried to find an employee in one of their
| stores, this won't be very surprising.
| reactordev wrote:
| Go in knowing exactly what you want and you'll be asked by no
| less than 3 employees if you need help finding anything.
| barbazoo wrote:
| Opposite data point, where I live, there's lots of people
| working the floor. I'm usually asked if I need help at least
| once when I'm there. Maybe it depends on the store or
| whatever the umbrella org is.
| AznHisoka wrote:
| Purely anecdotal, but I found Lowe's generally had much
| better customer service. But maybe it's just where I live
| RankingMember wrote:
| Yeah I think it'll be location dependent. FWIW I've got
| both by me and they're equally terrible as far as the
| availability and knowledge of their employees. Lowes edges
| out Home Depot a tiny bit for me simply because I've never
| been accosted by a sanctioned in-store roaming sales person
| for solar or siding at Lowes (yet!).
| antonymoose wrote:
| I get hit up for gutter guards every trip at my Lowe's. I
| have a stationary woman hawking Generac and HVAC installs
| at my Home Depot.
|
| I'd agree though, it's department dependent. The
| electrical at my HD is an unorganized mess, but their
| plumbing section is world-class. Lowe's is oddly flip-
| flopped. To Lowe's great credit, their staff has those
| little tablets with inventory locations on them including
| all the top-shelf and end cap locations the website
| doesn't show. Those usually save my trip, HD doesn't seem
| to have an equivalent.
| wnevets wrote:
| > Yeah I think it'll be location dependent
|
| I've found it to be very datetime dependent. I walking
| the aisles on a late Sunday night recently and the only
| time I saw an employee was at the self checkout before I
| left.
| tclancy wrote:
| That was true for a long time, but before that, Home
| Depot's customer service was terrific too. I think that's a
| cost that gets cut by a focus on shareholder value. Local
| hardware stores are still going to be better, with the
| caveat it may take a decade before they smile when you walk
| in.
| ultrarunner wrote:
| Too busy going all-in on Flock cameras. This was the nail in
| the coffin for me.
|
| [0] https://deflock.me/map#map=17/33.639428/-111.976540
| SoftTalker wrote:
| Seems that all the big box stores are doing that. Lowes does
| it here for sure.
| cyral wrote:
| Not entirely unsurprising due to the theft issues they face
| xeromal wrote:
| Yeah, I'm not sure why so many people seem pro-theft for a
| lack of a better term. I don't believe they are but there's
| so much resistance to locking up high value items
| especially if they're valuable ones.
| estimator7292 wrote:
| People are anti-surveillance, not pro-theft.
|
| Although, plenty of people _are_ pro-theft from the
| corporations sucking our towns and local economies dry
| and paying so little that their employees have to rely on
| foodstamps.
| Computer0 wrote:
| Home Depot making money doesn't make my town rich, the
| smaller shops making money do. The big corps just suck
| suck suck.
| ultrarunner wrote:
| Maybe you're not familiar with Flock Safety, but my
| comment is not about locking up high value items. It's
| more about my location information being shipped to weird
| police circles by big box stores.
|
| [0] deflock.me
|
| [1] https://www.youtube.com/watch?v=uB0gr7Fh6lY
| pilingual wrote:
| Perhaps just anti-shitty UX.
|
| https://dan.bulwinkle.net/blog/trader-joes-does-not-have-
| sur...
| VTimofeenko wrote:
| Given the absolute state of their website on mobile it's hardly
| surprising. It's faster to find an employee and ask them where an
| item is at instead of waiting for the search to finish, see that
| it the "current store" now points to a random location somewhere
| in a different state, pick the correct store and re-do the search
| kldavis4 wrote:
| +1
|
| also, when I'm in my local store it seems like cell connection
| goes to shit for some reason and then I have to jump on their
| in store wifi in order to search their website
| paleotrope wrote:
| They probably don't have any repeaters. All those metal
| shelves are going to interfere with the signal. I have the
| same experience.
| inferiorhuman wrote:
| Their in-store WiFi is a repeater more or less. It's one of
| those bullshit forced auto-join networks that you can't opt
| out of (at least on iOS). Because that's not a massive
| vector for phishing or anything.
| mirashii wrote:
| This is a network carrier setting, the issue is that
| T-Mobile (and maybe others) pushes a profile that does
| this as part of their network configuration.
| inferiorhuman wrote:
| Right, so you can't opt-out of it.
| freedomben wrote:
| Yes, although I've had terrible experience with their
| wifi. I'm sure it depends on the store, but coverage is
| usually terrible and highly spotty, so if you're walking
| around or standing in the wrong area, it stops working.
|
| At one point I also had to disable wireguard because I
| think it was triggering some sort of anti-abuse thing
| they had. It wasn't even using an exit node, just
| bridging me to my home network so I could access self-
| hosted services. I get the desire for anti-abuse, but
| that felt pretty draconian and I don't expect the average
| person to consider they might have to disable a VPN to
| get it to work, especially nowadays when many average
| people do have VPNs running.
| fn-mote wrote:
| Always wondered if this was a deliberate strategy to enable
| more tracking... but it sounds way beyond the ability of
| their corporate planning.
| danudey wrote:
| > when I'm in my local store it seems like cell connection
| goes to shit for some reason
|
| It's a giant steel and concrete box, that's probably the
| reason.
| craftkiller wrote:
| If you go to the home depot page for torque wrenches and click
| the filter for drive size, you get this list:
| 1/2 in 1/4 in 1 in 3/8 in 3/4 in
| Specialty
|
| Here is the same list in decimal to make the insanity plainly
| obvious: 0.5 0.25 1 0.375
| 0.75
|
| What sadistic lunatic made that sort order?! It's not based on
| size and it's not alphabetic.
| tomjakubowski wrote:
| I had to check what the gold standard McMaster-Carr does:
| their torque wrench drive size widget is sorted 1/4", 3/8",
| 1/2", 3/4", 1", 1 1/2". Glorious.
| https://www.mcmaster.com/products/torque-wrenches/
| jjice wrote:
| I'd expect nothing less from them. The right thing to do
| here is to implement a sorting key for different categories
| here. Since McMaster-Carr seems to be going to a category
| when you search, they seem to have better control over the
| available filters.
|
| I've found that on a site like Amazon or Walmart that'll
| let you do a more freeform sort, the filter options becomes
| absolutely god awful.
|
| Well done by McMaster-Carr. I assume they control their
| inventory a bit more than a marketplace like Home Depot,
| Walmart, or Amazon, so that's also an advantage.
| pacoWebConsult wrote:
| The schemas for Amazon and Walmart's product information
| are absolutely bonkers and constantly missing features
| that they demand be provided.
|
| Here's the XML Schema Definition for "Product" on Amazon
| [1]
|
| This is joined on each of the linked category schemas
| included at the type, of which each has unique properties
| that ultimately drive the metadata on a particular
| listing for the SKU. Its wrought with inconsistency,
| duplicated fields, and oftentimes not up-to-date with
| required information.
|
| Ultimately, this product catalog information gets
| provided to Amazon, Walmart, Target, and any other large
| 3rd party marketplace site as a feed file from a vendor
| to drive what product they can then list pricing and
| inventory against (through similar feeds).
|
| You are right that the control McMaster-Carr has on their
| catalog is the strategic and technological advantage.
|
| [1]: https://images-na.ssl-images-
| amazon.com/images/G/01/rainier/...
| wholinator2 wrote:
| Very interesting how nearly half the list is (assumedly)
| every single chemical listed under California Prop 65. Do
| they really need to specify exactly which chemical it is?
| I've seen thousands of prop 65 warnings in my life but
| I've literally never seen it tell me what chemical its
| warning me about. I just commented to a friends a couple
| weeks ago i wished they'd tell me what so i could look it
| up myself!
| progbits wrote:
| Mouser et al also do it right for mixed unit lists, eg.
| component dimensions are shown in their specified units but
| sorted as: 11mm, 12mm, 0.5in, 13mm, ...
| rockostrich wrote:
| McMaster-Carr's website is actually pretty impressive given
| how unassuming it is. It does a ton of pre-loading on hover
| and caching to make it feel like you're just navigating a
| static site. I didn't even realize that the page had a
| loading state until I enabled throttling from my network
| tab and immediately clicked on a link as soon as I hovered
| over it.
| dboreham wrote:
| Even more impressive is that it's something like 20 years
| old, and was basically the way it is now 20 years ago.
| hinkley wrote:
| Is it weird that I kinda want to work there?
| accidc wrote:
| No. You are likely and automatically extrapolating the
| attention to detail seen in the outcome into believing
| that it is a reflection of the attention , thought and
| method of their internal workings.
|
| Which is a good indicator, but you can't be sure of.
| Additionally you may imagine liking it but not enjoy it
| in life, even if true.
| SoftTalker wrote:
| It's probably a default ordering or an ordering by an unshown
| database ID value. It's a small enough set that it doesn't
| really matter for practical purposes, but I guess it does
| betray a lack of attention to detail.
| wiredfool wrote:
| It's simple alphabetic.
| neogodless wrote:
| Is "slash" (/) before or after "space" ( ) ... or both...
| before and after it?
|
| Is 8 before or after 4 in the alphabet?
| VTimofeenko wrote:
| Before. _E_ight vs _F_our.
| superturkey650 wrote:
| But _T_wo is also before _F_our
| VTimofeenko wrote:
| The sorting briefly switches to reverse order there, so
| no contradiction.
| bena wrote:
| No, there's no reasonable ordering going on.
|
| If it were ordered by ordinal values, "/" is 47 and " "
| is 32, so "1 in" would come before "1/2 in".
|
| It's not alphabetized by letter word. Because while
| "Eight" comes before "Four", "Specialty" would come
| before "Three".
|
| No matter which way you attempt to order it, something is
| out of order.
|
| Softtalker probably got it right. This is some default or
| id sort.
| antonvs wrote:
| 3/8 doesn't come before 3/4 alphabetically.
| bluedino wrote:
| Now look up impact wrenches. 1/2 in 1
| in 1/4 in 3/8 in 3/4 in 7/16 in
| rpcope1 wrote:
| > 7/16 in
|
| I had a major WTF moment there, until I realized that's
| probably for a hex driver (and thus something totally
| different than what I think of when someone says "impact
| wrench").
| RankingMember wrote:
| Thanks for reminding me to uninstall that godawful app, which
| is like their website, but somehow even slower/clunkier.
| porphyra wrote:
| I feel like the home depot website is fine. It's a lot better
| than most other shops, I've had a good experience finding the
| aisle and location of items, and it's generally accurate with
| the amount in stock at each location. If you didn't enable
| precise location or have bad cell signal then that is hardly
| the fault of the website.
| rigrassm wrote:
| Nah, I use both the website and their shitty web wrapper app
| on a regular basis and it's been a dumpster fire for at least
| the last 2-3 years. 3-5 years ago when they first rebuilt
| everything it was much more pleasant but at this point it's
| clear no one is maintaining it and have just let it bloat and
| rot
| VTimofeenko wrote:
| I will not argue with the stock part. When the search _does_
| finish, stock info is usually correct IME.
|
| What grinds my gears is the speed of this search, regardless
| of the phone reception. Even on the desktop it feels like
| they have a bunch of interns running a sneakernet. Or the
| website is laden with pointless javascript that slows
| everything down before the search is actually performed.
|
| I go to the same Home Depot every time. (Well I don't if I
| can help it, but that's beside the point). There is no reason
| they cannot store the preferred store in the localStorage or
| cookies or wherever else. Other stores have figured this out.
| danudey wrote:
| > Other stores have figured this out.
|
| Not CostCo though! I open their page and immediately 'Can
| Costco.ca use your location?" I say yes and then it asks me
| what province I'm in. I tell it, and then it defaults me to
| a store 30 minutes' drive from here and not the one five
| minutes away. Every. Time.
| garyfirestorm wrote:
| its generally in HD stores you never have cell signal or wifi
| freedomben wrote:
| This is definitely true and makes the experience shittier
| than it otherwise would be, but even with a great
| signal/connection it frequently loads so slowly that I've
| long run out of patience.
| LTL_FTC wrote:
| I have gotten in the habit of looking up what isle and
| bay the thing I need is before I get there, and then I
| screenshot it because too many times the page has needed
| to reload and start over
| brewtide wrote:
| I bought a water heater that had a large (1k!) instant
| rebate that you had to scan, sign up on website and show
| the emailed coupon to the person during cashing out. Took
| me 25 minutes wandering around the store to get enough
| reception to actually do this process. Made me chuckle,
| thinking how having it online only but before point of sale
| in the store was such a terrible, terrible idea.
| patagurbon wrote:
| Their internal setup was also an absolute mess as of 4 years
| ago. A horrific hybrid of _extremely_ legacy systems and new
| systems created around COVID which are both nicer and also
| deeply lacking in features we needed as floor workers.
|
| I understand that upgrading and migrating to new systems
| takes time but this process never seemed like it involved
| anyone on the ground.
| MSFT_Edging wrote:
| Jokes on you, all the employees do is use their mobile site as
| well.
| jgbuddy wrote:
| MSFT Edging
| freedomben wrote:
| Indeed, Home Depot's software is generally so bad. I remember
| around 2017/2018 time frame when they started showing up to big
| tech conferences (especially K8s and React.js conferences)
| really trying to modernize. I spent a few minutes talking to
| the people manning the booth (which were surprisingly high
| ranking in the company, at least by title), and came away
| thinking "I'm glad you're making an effort, but y'all really
| have no idea what you're doing." The left hand and the right
| hand had completely different ideas/priorities about how to
| accomplish their goals. I didn't want to make any judgments on
| a simple conversation at a conference, but at this point I
| think time has shown that it was pretty representative of how
| they were approaching it internally, and unsurprisingly it did
| not work out super well.
|
| Now that said, I don't want to minimize the difficulty in
| modernizing software at a corp like HD. It's wildly more
| difficult than most people can appreciate. I've consulted for
| companies trying to do it, and there are lots of challenges
| with legacy systems, migrations, and plenty of non-technical
| challenges as well.
|
| Shout out to Wal-mart for genuinely kicking ass at this though.
| I'm quickly becoming an Onn fanboy. Genearlly speaking, great
| products at great prices, from their USB cables up to their
| smart speakers and more. You can really tell from the product
| design and implementation that they are letting the nerds geek
| out and have fun! That in turn enables me to do the same :-)
| rpcope1 wrote:
| I'll bet money any new React/K8s/${WEBSCALE} stuff they're
| building is still just a wrapper over the same old inventory
| management they've been using for years...probably something
| like JDEdwards on AS/400.
| grosales wrote:
| You would lose that bet. Walmart has invested a LOT in
| modernizing stuff over the last 10 years. You cannot
| deliver groceries in less than an hour using the old
| inventory. It's not perfect, but what it's been done given
| the scale , it's nothing short of a miracle. Source: I have
| been working there for 10 years.
| TallGuyShort wrote:
| I've never had an employee know what a tool is, much less where
| to find it. All they're doing is doing this process on a
| slower, ruggedized phone.
|
| I literally watched someone Google "masonry bit" right in front
| of me.
| darrylb42 wrote:
| Though they should be on in store wifi. The big steel box
| store is a faraday cage that doesn't let the internet in.
| patagurbon wrote:
| The store I worked at for a while had a surprising number of
| real bearded experts, alongside at least a few younger folks
| who really understood the internal systems. It was great, but
| clearly was eroding as the experts retired and young folks
| with no experience were hired to replace them.
| pkaye wrote:
| Its hard to locate anything in their stores these days and its
| even harder to find any staff. So what I do is order for pickup
| and let them do the work.
| rurp wrote:
| I literally couldn't load their website with my previous Pixel
| phone. The performance was so terrible it would grind to a halt
| and freeze or crash.
| hinkley wrote:
| > the "current store" now points to a random location somewhere
| in a different state
|
| I thought that was just me. It gets the first, maybe the second
| digit of the zip code right and that's about it.
| Rebelgecko wrote:
| Someone made their own version of the HD app that works much
| better:
|
| https://www.reddit.com/r/Tools/comments/1opufvq/a_lightweigh...
| sowbug wrote:
| Or when the site tells you your store doesn't have a part in
| stock, but neglects to tell you that they do have 350 of the
| _identical_ part, different brand, in stock. Because who would
| ever buy a 1 /2-inch close Halex rigid conduit close nipple in-
| store right now when they could wait a few days for a 1/2-inch
| close Commercial Electric rigid conduit nipple?
| denysvitali wrote:
| Someone should use their GH token to fix their website
| y-c-o-m-b wrote:
| I think the same people/platform made the Best Buy mobile
| website, they look very similar. Just absolutely atrocious
| design. It's slow, the UI elements bounce all over the place,
| it forgets your selections, and godspeed if for whatever reason
| you need to refresh the page because something chose not to
| render. That's outside of the store on a good connection. Doing
| this IN the store is a whole new level of hair pulling
| frustration.
|
| Also I once asked an employee for help locating an item and
| they told me to pull up the app. I was like "you pull up the
| app", and we sat there for 5 minutes waiting for things to load
| until he decided he'll just help me locate the item lol
| danudey wrote:
| I'm just happy that Best Buy recently added the ability to
| filter out items they cannot actually sell me. The amount of
| searches I would do where I had to scroll through page after
| page of 'not available online' 'not available in store' items
| in order to find a search result they actually had was
| ridiculous.
|
| Now Home Depot for some reason just doesn't load on mobile
| (white screen) unless I disable content filtering in the
| browser. Classy.
| jgbuddy wrote:
| "Open Source Home Depot" has a nice ring to it
| rao-v wrote:
| I'm surprised that GitHub, OpenAI etc. doesn't have automation to
| scan the usual surfaces for hashes of their access tokens.
|
| It seems like a cheap and simple thing to offer your customers a
| little extra safety.
|
| Anybody interested in starting a platform agnostic service to do
| this?
| esafak wrote:
| Where was this token found, in an open source repo? There are
| numerous ways to scan commits, for free even in open source
| repos: https://docs.github.com/en/code-security/secret-
| scanning/int...
| tecleandor wrote:
| They at least scan GitHub for all kind of exposed tokens in
| public repositories, and even have partnerships with the
| companies where you can connect with those tokens (SaaS,
| PaaS...) to verify they're valid and even revoke them
| automatically if necessary.
| PokestarFan wrote:
| GitHub already has a program to scan for keys, since publishing
| Discord tokens by mistake used to get the token immediately
| revoked and a DM from the system account saying why
| 3eb7988a1663 wrote:
| I thought there were many first and third party services
| looking for this kind of thing (AWS, Github, GWS, crypto, etc
| tokens). Seems weird that a F500 company repo was not
| receiving the regular, let alone extra deep scanning which
| could have trivially found these.
|
| There was a recent post from someone who made the realization
| that most of these scanning services only investigate the
| main branch. Extra gold in them hills if you also consider
| development branches.
| freedomben wrote:
| They definitely do have automation to scan for this already.
| I've seen plenty of alerts (fortunately all false positives
| that triggered on example keys that weren't real). I don't know
| how comprehensive it is, but it does exist.
| dudeWithAMood wrote:
| I think there are crawlers that do that. Somehow I accidentally
| had a commit with an openai key in it, and when I published an
| open source repo with that commit within ~20 seconds I got an
| email from openai someone had retired my exposed key.
| tclancy wrote:
| Man, a year to grab all the Home Depot 2x4s you want! Someone
| could have built a sphere with those.
| AdmiralAsshat wrote:
| >When reached by TechCrunch on December 5, Home Depot
| spokesperson George Lane acknowledged receipt of our email but
| did not respond to follow-up emails asking for comment. The
| exposed token is no longer online, and the researcher said the
| token's access was revoked soon after our outreach.
|
| >
|
| >We also asked Lane if Home Depot has the technical means, such
| as logs, to determine if anyone else used the token during the
| months it was left online to access any of Home Depot's internal
| systems. We did not hear back.
|
| As soon as they realized that the researcher had contacted "the
| media", they probably escalated internally to their legal team
| before anyone else, who told them to shut up.
|
| The response, if one ever comes, will be a communication dense in
| lawyer-speak that admits no fault whatsoever.
| Computer0 wrote:
| Hope Home Depot is robbed for all their worldly possessions.
| dkdcio wrote:
| why?
| lillecarl wrote:
| I've accidentally pushed a personal PAT(ro) to both Github and
| gist because of poor hygiene in personal projects, both times
| Github dropped the PAT and notified me.
___________________________________________________________________
(page generated 2025-12-12 23:00 UTC)