Stop Putting Your Passwords Into Random Websites

watchTowr Labs scraped 80,000+ saved snippets from public code formatting websites like JSONFormatter and CodeBeautify and found thousands of exposed secrets in them. By exploiting the “Recent Links” feature and predictable URL patterns, they found Active Directory credentials, database passwords, API keys, and PII from government, banking, healthcare, and cybersecurity organizations. Their canary token experiment confirmed that malicious actors are actively harvesting and testing these exposed credentials, so maybe don’t paste your AWS keys into a website called “JSONBeautifier.io” next time. By the time Help Net Security covered the findings, JSONFormatter had temporarily disabled its Save feature (officially “to prevent NSFW content”), while CodeBeautify’s Recent Links page was still reachable.