Screenshots in public repos. The access path.
Coding agents published 13,000 internal screenshots to public repositories. No attacker and no vulnerability. 93 percent of the images sit in personal GitHub accounts.
The record
Entry point. pull request, developer asks for before and after screenshots.
The identity in the middle. The developer own git credentials, which the agent used because they were simply present.
What was reached. internal data, billing, treasury and unreleased product screens.
Coding agents published 13,000 internal screenshots to public repositories.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| pull request | Entry | developer asks for before and after screenshots |
| coding agent | Step | runs with the developer's own git credentials |
| public repo | Step | created by the agent to host the images |
| screenshots | Step | 13,000+ images, pinned to commit SHAs |
| internal data | Reached | billing, treasury and unreleased product screens |
Where a breakpoint would have been
The ability to create a public repository. No attacker and no vulnerability appear in this path, so the only step worth changing is the default visibility of a repository an agent creates under a personal account.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the Screenshots in public repos incident?
The published path starts at pull request, developer asks for before and after screenshots.
What did it reach?
The last step in the published path is internal data, billing, treasury and unreleased product screens.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.