Widely-deployed CI platform allowed job tokens to assume production deploy roles via an unscoped PassRole permission. Reported with replayed chain; vendor scoped the boundary policy.
A support-agent RAG index accepted tenant-writable documents; planted text directed the agent to read files outside its tool scope. Fix: instruction/data separation plus per-tool allowlists.
Merged-and-closed preview environments stayed routable with task IAM credentials intact — eight-month-old previews held production-adjacent access. Vendor added automatic TTL deprovisioning.
Vendor status appliance exposed /.git/ on EOL'd deployments, yielding full source including a live OAuth client_secret. Coordinated rotation + patch across affected installs.
A customer-agent tool could issue arbitrary POSTs to an internal webhook, allowing attacker-controlled content on the status page. Human-approval gate added before outbound calls.
How disclosure works here.
Every advisory follows the same path: verified chain → vendor report with evidence → 90-day coordinated window → public writeup only after fix ships. Researchers reporting to us get the same courtesy — see responsible disclosure.