From a Leaked Pipeline Credential to Bulk Data

Thu, 22 Oct 2026 00:00:00 -0400

Your dbt job’s service account has a key file sitting on a shared drive the early data team used, and another copy in a former contractor’s laptop backup. The key has no expiry date. Key creation has been blocked in your organisation for a while, but this key predates the block, and it still gets an access token today. Whoever has the file can use the job’s access to your BigQuery datasets, unless a VPC Service Controls perimeter limits where the account’s requests can come from.

Series-Pipeline-Attack-Surface on Sakura Sky: Cloud, Data, Security

From a Leaked Pipeline Credential to Bulk Data