Home Depot exposed access to internal systems for a year, says researcher

A security researcher found a Home Depot employee's GitHub access token exposed online (likely published by mistake) and discovered it granted access to hundreds of private repositories and cloud infrastructure including order fulfillment and inventory systems. The researcher’s private notifications to Home Depot went unanswered; TechCrunch’s outreach led to the token being revoked. The report does not provide evidence that the token was used maliciously while exposed.