The Hardcoded Horror Show

Exposing Security Failures in Production Systems

For the more serious breaches (and consequences), see fulcrumx7k9p2m3n8qvw4j2l5t6r9s1a3b8c4d5e2f7g9h0i1j3k6l8m2n5o7p.onion Note: This website does not traffic in data obtained via breaches/illegally. If security researchers are interested, they should visit research9x4m7n2p5k8w1v3t6y9u2i5o8p1q4r7s0a3d6f9g2h5j8k1l4m7n0q3t6v9y.onion

Bukwild/Goodness Inc's Contentful Catastrophe: When Agencies Go Rogue

September 4, 2025 | CRITICAL

Digital agency Bukwild (now Goodness Inc) left their Contentful admin token exposed in client-side JavaScript for nearly a full year, granting complete administrative access to twelve client websites, including household names like ClifBar, Ritz Crackers, and Amplitude.

Kwai's RSA Private Key Exposure: Authentication Bypass at Scale

August 31, 2025 | CRITICAL

RSA private key discovered hardcoded in Kwai's JavaScript bundles, enabling complete authentication bypass and admin access. Despite initial remediation, a second active key was discovered, highlighting systematic security failures in their development pipeline.