Travis CI exposes private creds of thousands of open source projects that rely on the service. Twitter user @peter_szilagyi Tweeted on Tuesday that “Between the 3 Sept and 10 Sept, secure env vars of *all* public @travisci repositories were injected into PR builds. Signing keys, access creds, API tokens. Felix Lange found this on the 7th and we’ve notified @travisci within the hour. Their only response being “Oops, please rotate the keys”, ignoring that *all* their infra was leaking. Not getting through, we’ve started reaching out to @github to have Travis blacklisted.” Needless to say, the community is livid!