Code beautifiers credentials leak exposes sensitive data

Researchers uncovered a widespread security issue involving online code-formatting tools. Developers used these platforms to clean up configuration files, JSON outputs and scripts. Many of those files contained sensitive authentication details. The mistake created a large-scale exposure that affected banks, government agencies and major technology organisations. The incident shows how everyday tools can create serious risks when they store code without proper access controls.

How the exposure happened

Platforms such as JSONFormatter and CodeBeautify allow users to paste code and generate cleaner, readable versions. Developers often use these services during tight deadlines. Many assume the pasted content remains private. The platforms, however, save submitted code and generate shareable links. Those links are predictable, which allows automated harvesting.

Researchers from WatchTowr examined the public “Recent Links” pages on both platforms. They collected more than eighty thousand files stored across several years. The data covered logs, configuration files and scripts. The scale of the exposure showed that many developers rely on beautifiers during routine tasks.

What sensitive data was leaked

The collected material held a wide range of sensitive information. Attackers could use several items immediately. The exposed data included:

Credentials and keys

• Active Directory usernames and passwords
• Database and cloud-service credentials
• API tokens and payment-gateway keys
• Repository access tokens

Infrastructure details

• Internal hostnames and IP ranges
• Deployment scripts and cloud-automation workflows
• SSH session logs containing operational details

Personal and organisational information

• KYC documents
• Customer-related metadata
• Financial exchange configuration files with active credentials

Some files originated from banks and major technology companies. One configuration file linked to a financial exchange included production-level access keys. A government body also exposed a PowerShell hardening script that revealed internal system design and security settings.

Why developers created this risk

The issue stems from convenience. Developers often embed secrets in configuration files. When they use code beautifiers to clean those files, they rarely remove the sensitive fields. Since beautifiers save pasted content, those secrets become accessible to anyone who discovers the link. The platforms never masked sensitive values, and their storage model offered no authentication barrier.

How organisations can prevent future leaks

Companies must treat online beautifiers as untrusted services. Several practical measures reduce the risk:

Security controls

• Remove all secrets from code before sharing or formatting
• Enforce secret-management tools to store credentials outside code
• Enable automated secret-scanning during commit, push and build steps

Process improvements

• Train developers on secure workflows
• Replace public beautifiers with internal, access-controlled alternatives
• Review past usage of public tools and rotate any exposed keys

Conclusion

The leak linked to code beautifiers credentials highlights a preventable security gap. Public formatting tools simplify development, yet they introduce major risks when they store unfiltered code. Organisations must enforce secure handling of secrets and provide safe alternatives. Strong hygiene, strict developer training and automated scanning help prevent similar exposures in the future.