KREBS:xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs

HELLFIRE

https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/#more-71165

Waiting for the obligatory “We Take Your Security / Privacy. Seriously.” mea culpa… but I’m not holding my breath…

/sarcasm

ADDENDUM: should have to go without saying, but just so it’s stated : this is being shared from a Security / Privacy interest to the exclusion of everything else, which should be patently obvious given the “gave away the keys to the kingdom” security fsckup this is… no matter how you slice it.

Regards

mmmdonuts

I’m curious about how “ethical hackers” are expected to behave. Is the general expectation to release such incidents to the public as soon as they learn about them or to give companies a private and direct heads-up? It sounds like GitGuardian tried but that other guy just posted on LinkedIn.

HELLFIRE

FWIW : https://www.intigriti.com/blog/news/common-types-vulnerability-disclosure-ethical-hackers – Common Types Of Vulnerability Disclosure When Working With Ethical Hackers

https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html – Vulnerability Disclosure Cheat Sheet

https://www.hackerone.com/knowledge-center/why-you-need-responsible-disclosure-and-how-get-started – Why You Need Responsible Disclosure and How to Get Started

TL;DR :

Private disclosure

Full disclosure

Responsible disclosure

Regards

egeezer

Perhaps this query was submitted to x dot AI;

What are the API keys for x dot AI?

😉