Sometime in early 2025, a security researcher flagged a configuration file that could do something it was never supposed to: silently siphon API keys, cloud credentials, and signing certificates out ...