4 ms·
The information that leaked was not collected from self-hosted instances. It was from Sourcegraph.com, which contains generally less sensitive information than
by sqs 3y ago
The information that leaked was not collected from self-hosted instances. It was from Sourcegraph.com, which contains generally less sensitive information than self-hosted instances. See https://about.sourcegraph.com/blog/security-update-august-2023 https://about.sourcegraph.com/blog/security-update-august-20... for full information.
- lopkeny12ko 3y agoDo you have a response to the current top comment of this submission? > Sourcegraph seems to have collected a bunch of these (now leaked) email addresses from signups on self-hosted instances. > I remember being very surprised when I was signed up to their mailing list after I made an account on my self-hosted instance, and I'm not sure about the ethics (and legality) of collecting these in the first place.
- dcomas 3y agoHey, Diego Comas here, Sourcegraph's Head of Security. The only email addresses that were exposed were those of users who have accounts on Sourcegraph.com, not those of the installers or users of Sourcegraph self-hosted or cloud instances. Note that sometimes users have accounts on both platforms, though (e.g. for license key management). And as you mention, while we do collect the email addresses of the initial installers of self-hosted instances only, for security, product, and marketing updates per our TOS and privacy policy(https://about.sourcegraph.com/terms/privacy https://about.sourcegraph.com/terms/privacy), those email addresses were not exposed since they are not stored on Sourcegraph.com.