CrowdSec confirms private source code leak, points to Tanstack backdoor as likely vector

What happened

CrowdSec, the company behind the open-source Security Engine, has confirmed that source code from its private GitHub repositories was leaked. According to a company statement, CrowdSec was notified on September 16 about an exposure that had taken place in May 2026, and its team verified and confirmed the report.

CrowdSec's codebase is split in two: a public side that hosts its free and open-source Security Engine, and a private side containing the source code for its SaaS console, some AWS Cloud routines, connectors, and automations. Only the private side is in scope; the open-source component was already public by design.

What the leak contained

Headline figures claiming 300 separate repositories are technically accurate, CrowdSec says, but only when the more than 130 public repositories are counted alongside the private ones. The company notes the total mostly reflects how the code is subdivided rather than its actual volume.

CrowdSec also declined to confirm claims about additional files or "internal development material", saying everything that leaked is code held in those repositories. The only API-related information involved was the token used by the CI/CD component itself.

On the question of sensitive data, the company is categorical: no client data, logins, passwords, organization names or anything similar was exposed, and CrowdSec says it does not store personal information or client logs in the first place. The impact is therefore limited to CrowdSec itself. The team combed the leak for tokens or credentials that could have enabled lateral movement and, so far, has found none.

A backdoored component as the likely vector

CrowdSec assesses that the Tanstack compromise was very likely the vector, drawing a parallel with the Mistral AI case, which it says involved the same route. The component was in use inside the organization during May and appears to have been backdoored to extract an API key with authorization to read the private codebase. The leak was only exploitable during a short window that month.

As a precaution, CrowdSec says it immediately rotated all the tokens and credentials that needed rotating. The company also credits Fuites Infos for the timely and professional way it reported the issue.

CrowdSec's assessment of the damage

The leaked code has value, but CrowdSec argues it cannot really be used against the company. Its effectiveness, the statement explains, depends on the scale and reach of its community, which source code alone cannot replicate. The SaaS code has been regularly audited, so its exposure should not pose an immediate threat either.

The company adds that most of the leaked code has changed substantially in the four months since the exposure, and that repurposing it elsewhere is unlikely because it only interacts with CrowdSec's own data and tools. It will keep monitoring for any abnormal activity as the investigation continues.

Why it matters

This incident is a data point in a supply-chain pattern that security teams should take seriously: a backdoored third-party component, an extracted API key, and a private codebase walked out through the front door. CrowdSec is now the second case it itself cites alongside Mistral AI, suggesting the same playbook is being reused against target after target.

For a security vendor specifically, source exposure is uncomfortable even when no customer data is involved. Attackers can now study the SaaS console, cloud routines, connectors, and automations looking for weaknesses, and CrowdSec's argument that its defenses rest on network scale rather than secrecy will be tested by whatever the company's monitoring turns up.

The mitigating factors here are worth noting: no PII or client logs existed to leak, credentials were rotated quickly, and the exploitation window was short. But the root cause, a trusted component in the build and CI/CD chain, is the part that other organizations cannot easily rule out about themselves.