So TL;DR the vuln here is that ToDesktop injected production secrets in the container they use to build customer-supplied images. This is completely incompeten

So TL;DR the vuln here is that ToDesktop injected production secrets in the container they use to build customer-supplied images. This is completely incompetent to the point of gross negligence. There is no excuse for this