Bitbucket artifact files can leak plaintext authentication secrets

**Executive summary:** Mandiant discovered that Bitbucket Pipelines artifact objects can inadvertently contain secured variables (including AWS authentication secrets) in plaintext when developers export environment variables or misconfigure bitbucket-pipelines.yml; such artifacts published or accessible publicly have been used by threat actors to breach AWS accounts. The report outlines the exposure vector, examples of how secrets are leaked to artifact files, mitigation advice (use dedicated secret managers, review artifacts, enable secret scanning), and Atlassian's response advising best practices.