CrowdSec confirms source code leak involving private SaaS console and routines

CrowdSec has confirmed the leak of its source code, particularly affecting private repositories related to its SaaS console and automation routines. The leak occurred in May 2026, but it was only reported and verified on September 16. While the company acknowledges the existence of the leak, it maintains that the core functionality and security of its services are not severely compromised.

Importantly, CrowdSec stated that no personally identifiable information (PII) or sensitive client data was leaked. The leaked code primarily consists of internal routines that cannot be directly exploited outside the CrowdSec environment. Without access to client data or critical credentials, the immediate risk to users appears to be limited.

CrowdSec has proactively rotated all necessary tokens and credentials to prevent any potential misuse from the leak. The company has also committed to monitoring for unusual activity stemming from the leaked code. Although some of the code may have value, the effectiveness of CrowdSec's services relies on its network effect, which cannot be replicated merely by having access to the source code.