Content in question: I found a file in a public repository on Github that contains a few 100 emails, some of them with a password (as bcrypt).

Verification: As I recognize several of the addresses, and know of the background of the file in question, I'm positive that the data are genuine and not intended to be public by the respective owners.

Publicity: I found no evidence of awareness of the repo anywhere.

How should I go about having the file removed? Is this something a CVE should be assigned to?

  • 1
    Does this repo on GitHub belong to the people listed, or is the owner related to these people?
    – Spotlight
    May 8, 2016 at 0:26
  • 5
    Can you tell me the URL I need a quick look for a sec... May 8, 2016 at 0:45
  • 1
    @Spotlight The repo belongs to the owner of a free service (which by now has been defunct for a while) to which the listed people subscribed.
    – mafu
    May 8, 2016 at 10:32
  • @JamesLu I assume that was a joke, but I don't understand why it was made or upvoted.
    – mafu
    May 8, 2016 at 10:33
  • @mafu yes, a joke May 8, 2016 at 13:19

1 Answer 1


This is an everyday event not worthy of a CVE.

It sounds like in this case it could be a simple mistake however the following are useful steps you can take or at least consider for any situation where credentials have been discovered.

Contact the affected users if appropriate: The best way to help if this were a case of a public dump of passwords would be sending a single BCC e-mail to each of the people affected letting them know their credentials have been disclosed and that they should quickly change all of their passwords and potentially look for evidence of abuse of these credentials. Don't copy the information or redistribute it, simply send a link to where it was publicly exposed at or tell them the site name.

Contact the owner and service provider abuse accounts: Likewise if you know how the information came to be disclosed/lost it would definitely be helpful to contact the organization(s) involved that lost the information so they can handle it appropriately. To do this simply send an e-mail to abuse@company.com and optionally a sales@company.com or other publicized contact address.

Do not sign any NDA's in this process. Some companies use NDA's to prevent disclosure it's an ugly issue just don't do it. State that you are only notifying them of the problem and do not want to be involved.

Contacting the affected users is very helpful simply because some organizations when contacted about the loss of such data literally do nothing and never tell the affected users (depending on what country it's hosted in this may not be breaking any local laws either). At least this gives the users a chance to protect themselves from further harm.

Be aware some password dumps are fake: The following doesn't apply to your specific situation but be aware that sometimes people post fake "password dumps" to sites like pastebin.com. So use appropriate language when writing your e-mails "It appears that something may have happened ...". etc...

Assuming this wasn't accidental you can politely request the information be removed but in the case of a password dump if it was made public elsewhere the user may have no obligation to remove it (not your situation I just mention this for others). Again passwords being dumped on-line is a common occurrence and there are many sites hosting millions of exposed passwords from compromised sites.

  • These really aren't exposed passwords. Just hashes May 7, 2016 at 22:19
  • @NeilSmithline Depending on the hash algorithm, it might as well be the password itself.
    – corsiKa
    May 8, 2016 at 1:48
  • 2
    @corsiKa OP says bcrypt. That's definitely more secure than passwords May 8, 2016 at 1:52
  • $2a$10 passwords, but still not something I would want exposed.
    – mafu
    May 8, 2016 at 10:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .