> ... heads up to fellow Mac Admins and anyone else who uses or deploys Box Sync to ensure that the 4.0.6035 update is applied ASAP. There is no way of knowing

> ... heads up to fellow Mac Admins and anyone else who uses or deploys Box Sync to ensure that the 4.0.6035 update is applied ASAP. There is no way of knowing who else has been aware of the exposed information before me and whether or not it may have been used to access Box customer data. This is especially important in environments that use a managed software update workflow which may be holding back automatic updates until specific action is taken by an admin. Looks like that second-to-last sentence was inserted after an initial writing, since the last line refers again to the urgency to update. In my opinion, there's far too little discussion (just the one line) about the implications of what might have been exposed here. In other words, this sounds much more like evidence of a possible data breach than just a client security bug that is fixed with an updated version. Of course, that discussion/clarification should come directly from Box. If information like S3 credentials was exposed, I assume Box's response was to immediately change all the relevant credentials (and be sure the new ones aren't exposed in later versions). If that's the case, then the client update itself probably isn't the critical thing to worry about at this point, right? It's a bit like saying "oops, we accidentally pushed secrets to our public GitHub repo and didn't know about it until someone else pointed it out" and that person saying "quick, everyone pull down the latest revision that doesn't include the credentials."