Lessons from the Mercedes-Benz GitHub source code leak

RedHunt Labs discovered a publicly exposed GitHub access token belonging to a Mercedes‑Benz employee that granted unrestricted access to internal GitHub Enterprise repositories, potentially exposing source code, database connection strings, cloud keys, SSO passwords, API keys and other sensitive development artifacts; Mercedes revoked the token and removed the public repository after notification. The report frames this as part of a wider problem of leaked developer secrets and software supply‑chain risk, cites prior Mercedes supply‑chain exposures, and urges stronger supply‑chain security controls beyond traditional AppSec.