There has been a post on Niebezpiecznik.pl, a popular InfoSec blog, describing an interesting situation.
A company mistakenly granted access to their BitBucket repo to a a random programmer. This programmer subsequently alerted various employees of the company, urging them to revoke access ASAP. He found these employees sluggish (for example, one said he would only revoke the access once he was back from his vacation), so alerted the Niebezpiecznik blog, which subsequently contacted the company. Only then was access revoked.
It is clear that the programmer considered the lack of prompt revocation of access to be a very grave oversight on behalf of the company's security policy. And here is where I'm surprised.
So, let's consider this from the company's point of view. Someone contacts them, claiming that he has been spuriously granted access to their private repo and urging them to revoke this access. Now this person either is or is not interested in the contents of this repo; he also either has or has not strong enough moral values to refrain from downloading it. If he's willing to inspect the contents of the repo, he's already had ample time to do this; and if he hasn't done this yet, then he will likely still not have done this by the time the employee is back from his vacation. In other words, the milk has already spilled and nothing worse than what has already happened is likely to happen in the future.
As a result, I would think, the situation is no longer urgent and can soundly wait until the employee is back from his vacation.
Where am I wrong?