Some time ago a developer in my team accidentally published some code to his GitHub repository containing ENV_VARS that belonged to our company's SendGrid account. Fortunately I noticed this as soon as he created the repository and it was deleted.
Around 12 hours after this happened, SendGrid locked the company account and mentioned this was done because they found account details in a GitHub repository (the one my developer previously published and subsequently deleted).
This got me thinking: would the "bot" that SendGrid uses be searching GitHub with the username/password (in plain text)? If so, then this is a big security issue on their side, right (storing passwords in plain text)?
Even if they were encrypting the password and decrypting the password to search GitHub for exposed credentials, this would still seem unsafe as the password would be exposed to GitHub via a search string parameter.
Here is an example of what the ENV_VARS for the SendGrid account look like:
MAIL_DRIVER=smtp MAIL_HOST=smtp.sendgrid.net MAIL_PORT=587 MAIL_USERNAME=username MAIL_PASSWORD=null MAIL_ENCRYPTION=tls