Home Depot GitHub token exposed for a year, granted access to internal systems

https://techcrunch.com/2025/12/12/home-depot-exposed-access-to-internal-systems-for-a-year-says-researcher/

133•kernelrocks•4h ago

Comments

indigodaddy•3h ago

Wow, the non-response/communication at any time by Home Depot to all parties involved in trying to help them, is staggering.

el_benhameen•3h ago

If you’ve ever tried to find an employee in one of their stores, this won’t be very surprising.

reactordev•3h ago

Go in knowing exactly what you want and you’ll be asked by no less than 3 employees if you need help finding anything.

barbazoo•3h ago

Opposite data point, where I live, there's lots of people working the floor. I'm usually asked if I need help at least once when I'm there. Maybe it depends on the store or whatever the umbrella org is.

AznHisoka•3h ago

Purely anecdotal, but I found Lowe's generally had much better customer service. But maybe it's just where I live

RankingMember•3h ago

Yeah I think it'll be location dependent. FWIW I've got both by me and they're equally terrible as far as the availability and knowledge of their employees. Lowes edges out Home Depot a tiny bit for me simply because I've never been accosted by a sanctioned in-store roaming sales person for solar or siding at Lowes (yet!).

antonymoose•2h ago

I get hit up for gutter guards every trip at my Lowe’s. I have a stationary woman hawking Generac and HVAC installs at my Home Depot.

I’d agree though, it’s department dependent. The electrical at my HD is an unorganized mess, but their plumbing section is world-class. Lowe’s is oddly flip-flopped. To Lowe’s great credit, their staff has those little tablets with inventory locations on them including all the top-shelf and end cap locations the website doesn’t show. Those usually save my trip, HD doesn’t seem to have an equivalent.

wnevets•2h ago

> Yeah I think it'll be location dependent

I've found it to be very datetime dependent. I walking the aisles on a late Sunday night recently and the only time I saw an employee was at the self checkout before I left.

tclancy•1h ago

That was true for a long time, but before that, Home Depot's customer service was terrific too. I think that's a cost that gets cut by a focus on shareholder value. Local hardware stores are still going to be better, with the caveat it may take a decade before they smile when you walk in.

ultrarunner•2h ago

Too busy going all-in on Flock cameras. This was the nail in the coffin for me.

[0] https://deflock.me/map#map=17/33.639428/-111.976540

SoftTalker•2h ago

Seems that all the big box stores are doing that. Lowes does it here for sure.

cyral•2h ago

Not entirely unsurprising due to the theft issues they face

xeromal•56m ago

Yeah, I'm not sure why so many people seem pro-theft for a lack of a better term. I don't believe they are but there's so much resistance to locking up high value items especially if they're valuable ones.

estimator7292•37m ago

People are anti-surveillance, not pro-theft.

Although, plenty of people are pro-theft from the corporations sucking our towns and local economies dry and paying so little that their employees have to rely on foodstamps.

Computer0•27m ago

Home Depot making money doesn't make my town rich, the smaller shops making money do. The big corps just suck suck suck.

ultrarunner•35m ago

Maybe you're not familiar with Flock Safety, but my comment is not about locking up high value items. It's more about my location information being shipped to weird police circles by big box stores.

[0] deflock.me

[1] https://www.youtube.com/watch?v=uB0gr7Fh6lY

VTimofeenko•3h ago

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

kldavis4•3h ago

also, when I'm in my local store it seems like cell connection goes to shit for some reason and then I have to jump on their in store wifi in order to search their website

paleotrope•2h ago

They probably don't have any repeaters. All those metal shelves are going to interfere with the signal. I have the same experience.

inferiorhuman•2h ago

Their in-store WiFi is a repeater more or less. It's one of those bullshit forced auto-join networks that you can't opt out of (at least on iOS). Because that's not a massive vector for phishing or anything.

mirashii•2h ago

This is a network carrier setting, the issue is that T-Mobile (and maybe others) pushes a profile that does this as part of their network configuration.

inferiorhuman•2h ago

Right, so you can't opt-out of it.

freedomben•1h ago

Yes, although I've had terrible experience with their wifi. I'm sure it depends on the store, but coverage is usually terrible and highly spotty, so if you're walking around or standing in the wrong area, it stops working.

At one point I also had to disable wireguard because I think it was triggering some sort of anti-abuse thing they had. It wasn't even using an exit node, just bridging me to my home network so I could access self-hosted services. I get the desire for anti-abuse, but that felt pretty draconian and I don't expect the average person to consider they might have to disable a VPN to get it to work, especially nowadays when many average people do have VPNs running.

fn-mote•2h ago

Always wondered if this was a deliberate strategy to enable more tracking… but it sounds way beyond the ability of their corporate planning.

danudey•28m ago

> when I'm in my local store it seems like cell connection goes to shit for some reason

It's a giant steel and concrete box, that's probably the reason.

craftkiller•3h ago

If you go to the home depot page for torque wrenches and click the filter for drive size, you get this list:

  1/2 in
  1/4 in
  1 in
  3/8 in
  3/4 in
  Specialty

Here is the same list in decimal to make the insanity plainly obvious:

What sadistic lunatic made that sort order?! It's not based on size and it's not alphabetic.

tomjakubowski•3h ago

I had to check what the gold standard McMaster-Carr does: their torque wrench drive size widget is sorted 1/4", 3/8", 1/2", 3/4", 1", 1 1/2". Glorious. https://www.mcmaster.com/products/torque-wrenches/

jjice•2h ago

I'd expect nothing less from them. The right thing to do here is to implement a sorting key for different categories here. Since McMaster-Carr seems to be going to a category when you search, they seem to have better control over the available filters.

I've found that on a site like Amazon or Walmart that'll let you do a more freeform sort, the filter options becomes absolutely god awful.

Well done by McMaster-Carr. I assume they control their inventory a bit more than a marketplace like Home Depot, Walmart, or Amazon, so that's also an advantage.

pacoWebConsult•1h ago

The schemas for Amazon and Walmart's product information are absolutely bonkers and constantly missing features that they demand be provided.

Here's the XML Schema Definition for "Product" on Amazon [1]

This is joined on each of the linked category schemas included at the type, of which each has unique properties that ultimately drive the metadata on a particular listing for the SKU. Its wrought with inconsistency, duplicated fields, and oftentimes not up-to-date with required information.

Ultimately, this product catalog information gets provided to Amazon, Walmart, Target, and any other large 3rd party marketplace site as a feed file from a vendor to drive what product they can then list pricing and inventory against (through similar feeds).

You are right that the control McMaster-Carr has on their catalog is the strategic and technological advantage.

[1]: https://images-na.ssl-images-amazon.com/images/G/01/rainier/...

wholinator2•1h ago

Very interesting how nearly half the list is (assumedly) every single chemical listed under California Prop 65. Do they really need to specify exactly which chemical it is? I've seen thousands of prop 65 warnings in my life but I've literally never seen it tell me what chemical its warning me about. I just commented to a friends a couple weeks ago i wished they'd tell me what so i could look it up myself!

progbits•1h ago

Mouser et al also do it right for mixed unit lists, eg. component dimensions are shown in their specified units but sorted as: 11mm, 12mm, 0.5in, 13mm, ...

rockostrich•1h ago

McMaster-Carr's website is actually pretty impressive given how unassuming it is. It does a ton of pre-loading on hover and caching to make it feel like you're just navigating a static site. I didn't even realize that the page had a loading state until I enabled throttling from my network tab and immediately clicked on a link as soon as I hovered over it.

dboreham•58m ago

Even more impressive is that it's something like 20 years old, and was basically the way it is now 20 years ago.

hinkley•1h ago

Is it weird that I kinda want to work there?

accidc•23m ago

No. You are likely and automatically extrapolating the attention to detail seen in the outcome into believing that it is a reflection of the attention , thought and method of their internal workings.

Which is a good indicator, but you can’t be sure of. Additionally you may imagine liking it but not enjoy it in life, even if true.

SoftTalker•2h ago

It's probably a default ordering or an ordering by an unshown database ID value. It's a small enough set that it doesn't really matter for practical purposes, but I guess it does betray a lack of attention to detail.

wiredfool•2h ago

It’s simple alphabetic.

neogodless•2h ago

Is "slash" (/) before or after "space" ( ) ... or both... before and after it?

Is 8 before or after 4 in the alphabet?

VTimofeenko•2h ago

Before. _E_ight vs _F_our.

superturkey650•2h ago

But _T_wo is also before _F_our

VTimofeenko•1h ago

The sorting briefly switches to reverse order there, so no contradiction.

bena•2h ago

No, there's no reasonable ordering going on.

If it were ordered by ordinal values, "/" is 47 and " " is 32, so "1 in" would come before "1/2 in".

It's not alphabetized by letter word. Because while "Eight" comes before "Four", "Specialty" would come before "Three".

No matter which way you attempt to order it, something is out of order.

Softtalker probably got it right. This is some default or id sort.

antonvs•1h ago

3/8 doesn’t come before 3/4 alphabetically.

bluedino•1h ago

Now look up impact wrenches.

  1/2 in
  1 in
  1/4 in
  3/8 in
  3/4 in
  7/16 in

rpcope1•57m ago

> 7/16 in

I had a major WTF moment there, until I realized that's probably for a hex driver (and thus something totally different than what I think of when someone says "impact wrench").

RankingMember•3h ago

Thanks for reminding me to uninstall that godawful app, which is like their website, but somehow even slower/clunkier.

porphyra•3h ago

I feel like the home depot website is fine. It's a lot better than most other shops, I've had a good experience finding the aisle and location of items, and it's generally accurate with the amount in stock at each location. If you didn't enable precise location or have bad cell signal then that is hardly the fault of the website.

rigrassm•2h ago

Nah, I use both the website and their shitty web wrapper app on a regular basis and it's been a dumpster fire for at least the last 2-3 years. 3-5 years ago when they first rebuilt everything it was much more pleasant but at this point it's clear no one is maintaining it and have just let it bloat and rot

VTimofeenko•2h ago

I will not argue with the stock part. When the search _does_ finish, stock info is usually correct IME.

What grinds my gears is the speed of this search, regardless of the phone reception. Even on the desktop it feels like they have a bunch of interns running a sneakernet. Or the website is laden with pointless javascript that slows everything down before the search is actually performed.

I go to the same Home Depot every time. (Well I don't if I can help it, but that's beside the point). There is no reason they cannot store the preferred store in the localStorage or cookies or wherever else. Other stores have figured this out.

danudey•29m ago

> Other stores have figured this out.

Not CostCo though! I open their page and immediately 'Can Costco.ca use your location?" I say yes and then it asks me what province I'm in. I tell it, and then it defaults me to a store 30 minutes' drive from here and not the one five minutes away. Every. Time.

garyfirestorm•2h ago

its generally in HD stores you never have cell signal or wifi

freedomben•2h ago

This is definitely true and makes the experience shittier than it otherwise would be, but even with a great signal/connection it frequently loads so slowly that I've long run out of patience.

LTL_FTC•1h ago

I have gotten in the habit of looking up what isle and bay the thing I need is before I get there, and then I screenshot it because too many times the page has needed to reload and start over

brewtide•1h ago

I bought a water heater that had a large (1k!) instant rebate that you had to scan, sign up on website and show the emailed coupon to the person during cashing out. Took me 25 minutes wandering around the store to get enough reception to actually do this process. Made me chuckle, thinking how having it online only but before point of sale in the store was such a terrible, terrible idea.

patagurbon•1h ago

Their internal setup was also an absolute mess as of 4 years ago. A horrific hybrid of extremely legacy systems and new systems created around COVID which are both nicer and also deeply lacking in features we needed as floor workers.

I understand that upgrading and migrating to new systems takes time but this process never seemed like it involved anyone on the ground.

MSFT_Edging•2h ago

Jokes on you, all the employees do is use their mobile site as well.

jgbuddy•2h ago

MSFT Edging

freedomben•2h ago

Indeed, Home Depot's software is generally so bad. I remember around 2017/2018 time frame when they started showing up to big tech conferences (especially K8s and React.js conferences) really trying to modernize. I spent a few minutes talking to the people manning the booth (which were surprisingly high ranking in the company, at least by title), and came away thinking "I'm glad you're making an effort, but y'all really have no idea what you're doing." The left hand and the right hand had completely different ideas/priorities about how to accomplish their goals. I didn't want to make any judgments on a simple conversation at a conference, but at this point I think time has shown that it was pretty representative of how they were approaching it internally, and unsurprisingly it did not work out super well.

Now that said, I don't want to minimize the difficulty in modernizing software at a corp like HD. It's wildly more difficult than most people can appreciate. I've consulted for companies trying to do it, and there are lots of challenges with legacy systems, migrations, and plenty of non-technical challenges as well.

Shout out to Wal-mart for genuinely kicking ass at this though. I'm quickly becoming an Onn fanboy. Genearlly speaking, great products at great prices, from their USB cables up to their smart speakers and more. You can really tell from the product design and implementation that they are letting the nerds geek out and have fun! That in turn enables me to do the same :-)

rpcope1•52m ago

I'll bet money any new React/K8s/${WEBSCALE} stuff they're building is still just a wrapper over the same old inventory management they've been using for years...probably something like JDEdwards on AS/400.

grosales•4m ago

You would lose that bet. Walmart has invested a LOT in modernizing stuff over the last 10 years. You cannot deliver groceries in less than an hour using the old inventory. It's not perfect, but what it's been done given the scale , it's nothing short of a miracle. Source: I have been working there for 10 years.

TallGuyShort•2h ago

I've never had an employee know what a tool is, much less where to find it. All they're doing is doing this process on a slower, ruggedized phone.

I literally watched someone Google "masonry bit" right in front of me.

darrylb42•1h ago

Though they should be on in store wifi. The big steel box store is a faraday cage that doesn't let the internet in.

patagurbon•1h ago

The store I worked at for a while had a surprising number of real bearded experts, alongside at least a few younger folks who really understood the internal systems. It was great, but clearly was eroding as the experts retired and young folks with no experience were hired to replace them.

pkaye•1h ago

Its hard to locate anything in their stores these days and its even harder to find any staff. So what I do is order for pickup and let them do the work.

rurp•1h ago

I literally couldn't load their website with my previous Pixel phone. The performance was so terrible it would grind to a halt and freeze or crash.

hinkley•1h ago

> the "current store" now points to a random location somewhere in a different state

I thought that was just me. It gets the first, maybe the second digit of the zip code right and that's about it.

Rebelgecko•1h ago

Someone made their own version of the HD app that works much better:

https://www.reddit.com/r/Tools/comments/1opufvq/a_lightweigh...

sowbug•1h ago

Or when the site tells you your store doesn't have a part in stock, but neglects to tell you that they do have 350 of the identical part, different brand, in stock. Because who would ever buy a 1/2-inch close Halex rigid conduit close nipple in-store right now when they could wait a few days for a 1/2-inch close Commercial Electric rigid conduit nipple?

denysvitali•1h ago

Someone should use their GH token to fix their website

y-c-o-m-b•34m ago

I think the same people/platform made the Best Buy mobile website, they look very similar. Just absolutely atrocious design. It's slow, the UI elements bounce all over the place, it forgets your selections, and godspeed if for whatever reason you need to refresh the page because something chose not to render. That's outside of the store on a good connection. Doing this IN the store is a whole new level of hair pulling frustration.

Also I once asked an employee for help locating an item and they told me to pull up the app. I was like "you pull up the app", and we sat there for 5 minutes waiting for things to load until he decided he'll just help me locate the item lol

danudey•31m ago

I'm just happy that Best Buy recently added the ability to filter out items they cannot actually sell me. The amount of searches I would do where I had to scroll through page after page of 'not available online' 'not available in store' items in order to find a search result they actually had was ridiculous.

Now Home Depot for some reason just doesn't load on mobile (white screen) unless I disable content filtering in the browser. Classy.

jgbuddy•2h ago

"Open Source Home Depot" has a nice ring to it

rao-v•2h ago

I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens.

It seems like a cheap and simple thing to offer your customers a little extra safety.

Anybody interested in starting a platform agnostic service to do this?

esafak•2h ago

Where was this token found, in an open source repo? There are numerous ways to scan commits, for free even in open source repos: https://docs.github.com/en/code-security/secret-scanning/int...

tecleandor•2h ago

They at least scan GitHub for all kind of exposed tokens in public repositories, and even have partnerships with the companies where you can connect with those tokens (SaaS, PaaS...) to verify they're valid and even revoke them automatically if necessary.

PokestarFan•1h ago

GitHub already has a program to scan for keys, since publishing Discord tokens by mistake used to get the token immediately revoked and a DM from the system account saying why

3eb7988a1663•31m ago

I thought there were many first and third party services looking for this kind of thing (AWS, Github, GWS, crypto, etc tokens). Seems weird that a F500 company repo was not receiving the regular, let alone extra deep scanning which could have trivially found these.

There was a recent post from someone who made the realization that most of these scanning services only investigate the main branch. Extra gold in them hills if you also consider development branches.

freedomben•1h ago

They definitely do have automation to scan for this already. I've seen plenty of alerts (fortunately all false positives that triggered on example keys that weren't real). I don't know how comprehensive it is, but it does exist.

dudeWithAMood•1h ago

I think there are crawlers that do that. Somehow I accidentally had a commit with an openai key in it, and when I published an open source repo with that commit within ~20 seconds I got an email from openai someone had retired my exposed key.

tclancy•1h ago

Man, a year to grab all the Home Depot 2x4s you want! Someone could have built a sphere with those.

AdmiralAsshat•40m ago

>When reached by TechCrunch on December 5, Home Depot spokesperson George Lane acknowledged receipt of our email but did not respond to follow-up emails asking for comment. The exposed token is no longer online, and the researcher said the token’s access was revoked soon after our outreach.

>We also asked Lane if Home Depot has the technical means, such as logs, to determine if anyone else used the token during the months it was left online to access any of Home Depot’s internal systems. We did not hear back.

As soon as they realized that the researcher had contacted "the media", they probably escalated internally to their legal team before anyone else, who told them to shut up.

The response, if one ever comes, will be a communication dense in lawyer-speak that admits no fault whatsoever.

Computer0•29m ago

Hope Home Depot is robbed for all their worldly possessions.

dkdcio•10m ago

why?

GNU Unifont

macOS 26.2 enables fast AI clusters with RDMA over Thunderbolt

Security issues with electronic invoices

Rats Play Doom

Ensuring a National Policy Framework for Artificial Intelligence

Show HN: Tiny VM sandbox in C with apps in Rust, C and Zig

Pg_ClickHouse: A Postgres extension for querying ClickHouse

SQLite JSON at full index speed using generated columns

Motion (YC W20) Is Hiring Senior Staff Front End Engineers

4 billion if statements (2023)

Secondary school maths showing that AI systems don't think

String theory inspires a brilliant, baffling new math proof

CM0 – A new Raspberry Pi you can't buy

Async DNS

Microservices should form a polytree

Good conversations have lots of doorknobs (2022)

Bit flips: How cosmic rays grounded a fleet of aircraft

Epic celebrates "the end of the Apple Tax" after court win in iOS payments case

Google releases its new Google Sans Flex font as open source

Fedora: Open-source repository for long-term digital preservation

New Kindle feature uses AI to answer questions about books

Fast Median Filter over arbitrary datatypes

The true story of the Windows 3.1 'Hot Dog Stand' color scheme

From text to token: How tokenization pipelines work

Funerary figurines found in royal tomb identifies Pharoah

The tiniest yet real telescope I've built

Home Depot GitHub token exposed for a year, granted access to internal systems

Open sourcing the Remix Store

The Average Founder Ages 6 Months Each Year

Framework Raises DDR5 Memory Prices by 50% for DIY Laptops

GNU Unifont

macOS 26.2 enables fast AI clusters with RDMA over Thunderbolt

Security issues with electronic invoices

Rats Play Doom

Ensuring a National Policy Framework for Artificial Intelligence

Show HN: Tiny VM sandbox in C with apps in Rust, C and Zig

Pg_ClickHouse: A Postgres extension for querying ClickHouse

SQLite JSON at full index speed using generated columns

Motion (YC W20) Is Hiring Senior Staff Front End Engineers

4 billion if statements (2023)

Secondary school maths showing that AI systems don't think

String theory inspires a brilliant, baffling new math proof

CM0 – A new Raspberry Pi you can't buy

Async DNS

Microservices should form a polytree

Good conversations have lots of doorknobs (2022)

Bit flips: How cosmic rays grounded a fleet of aircraft

Epic celebrates "the end of the Apple Tax" after court win in iOS payments case

Google releases its new Google Sans Flex font as open source

Fedora: Open-source repository for long-term digital preservation

New Kindle feature uses AI to answer questions about books

Fast Median Filter over arbitrary datatypes

The true story of the Windows 3.1 'Hot Dog Stand' color scheme

From text to token: How tokenization pipelines work

Funerary figurines found in royal tomb identifies Pharoah

The tiniest yet real telescope I've built

Home Depot GitHub token exposed for a year, granted access to internal systems

Open sourcing the Remix Store

The Average Founder Ages 6 Months Each Year

Framework Raises DDR5 Memory Prices by 50% for DIY Laptops

Home Depot GitHub token exposed for a year, granted access to internal systems

Comments