Shadow IT: Personal GitHub Repos Expose Employee Cloud Secrets

**Executive Summary:** Researchers discovered that personal GitHub repositories belonging to employees at Microsoft, Red Hat, and Tigera accidentally exposed cloud credentials (including a privileged Azure Container Registry token) that could permit downloading, uploading, or overwriting private container images and enable supply-chain or runtime compromise; vendors invalidated the tokens and remediated the issues, and the report calls for scanning, least-privilege scoped keys, and secret rotation to mitigate shadow IT risks.