Security researchers at WatchTowr Labs have uncovered widespread leakage of authentication credentials and sensitive data from two popular online code formatting tools, JSONFormatter and CodeBeautify. By harvesting content from the platforms’ “Recent Links” feature and related APIs, the team collected more than 80,000 saved JSON submissions spanning roughly five years of JSONFormatter history and one year of CodeBeautify data, amounting to over 5 GB of enriched JSON.
The dataset contained thousands of secrets directly relevant to identity and access security, including Active Directory credentials, database and cloud keys, private keys, code repository tokens, CI/CD secrets, payment gateway keys, and API tokens. Researchers also found extensive personally identifiable information, such as full KYC records tied to a major bank, along with links to video interviews hosted on the bank’s own infrastructure. The exposed organizations span critical national infrastructure, government, banking, finance, insurance, aerospace, telecommunications, healthcare, education, technology, cybersecurity, and retail.
WatchTowr assembled this trove by using the tools’ legitimate save and sharing functionality. When users click “save,” the services generate shareable URLs, which are then listed on public “Recent Links” pages following a predictable URL structure. By crawling these pages and querying the associated getDataFromID API endpoints, the researchers retrieved raw JSON content for tens of thousands of entries, many of which had clearly been copied directly from production systems.
To determine whether malicious actors were already abusing this exposure, WatchTowr planted canary AWS credentials in accessible JSON entries. Attempts to use the fake keys were recorded within about 48 hours, even after the visible links had expired, suggesting that third parties are already scraping these platforms for secrets. Other media analyses of the research highlight that the problem stems as much from developer behavior as from platform design, since users are pasting sensitive configuration data, cloud credentials, and PII into third party tools that were never intended to act as secure vaults.
For CISOs and security leaders, the case underscores the need to treat code-formatting and debugging sites as part of the external attack surface. Recommended mitigations include scanning for exposed secrets, revoking and rotating credentials that may have been leaked, and updating secure coding policies and training to explicitly prohibit pasting sensitive data into public web tools. The incident also highlights the importance of monitoring for anomalous use of credentials, especially cloud and API keys, that might have been compromised through nontraditional channels such as developer utilities.
The findings follow broader concerns about security vulnerabilities in digital identity systems and credential management in enterprise environments.
Sources: WatchTowr Labs, BleepingComputer, SecurityWeek, CSO Online
—
By Cass Kennedy
