Public Travis CI Logs (Still) Expose Users to Cyber Attacks

Team Nautilus discovered that Travis CI APIs allow unauthenticated enumeration and retrieval of historical build logs (estimated range ~4.28M–774.8M, roughly 770 million logs), leading to the exposure of tens of thousands of secrets (GitHub OAuth tokens, AWS keys, Docker Hub credentials). Their research documents enumeration methods, sampling results (~73,000 extracted tokens/secrets), simulated attack scenarios showing lateral movement, supply-chain and data-exfiltration risks, and recommends immediate mitigations such as key rotation, secrets scanning, least-privilege controls, and improved CI logging practices.