AWS key exposed in JavaScript may have lit way to Beacon's charity data
- ID
- 13796
- Status
- summarized
- Published
- 13 Aug 2026, 7:34 PM
- Fetched
- 13 Aug 2026, 8:28 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/13/aws-key-exposed-in-javascript-may-have-lit-way-to-beacons-charity-data/5287303
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.5
- Created
- 13 Aug 2026, 8:29 PM
- Tags
- Audience
- developerssaas_founders
What happened
Beacon, a CRM provider serving 1,500+ charities, says an AWS access key likely exposed in public JavaScript build artifacts is the leading suspect in a July 27 breach. The attacker copied the entire customer database—including attachments—and probably downloaded it in readable form within 1 hour 27 minutes, despite data being encrypted at rest, because the compromised key allowed decryption. Beacon's logs cannot identify which specific records were exfiltrated.
Why it matters
If you ship JavaScript bundles to browsers, scan your build artifacts for embedded cloud credentials before deployment—this incident shows that encryption at rest is meaningless when the access key that can decrypt it is sitting in a public JS file. Founders running SaaS on AWS should verify that IAM keys are never bundled into frontend assets and that CI/CD pipelines include secret-detection steps.
Discussion angle
Walk through how an AWS key ends up in a JS build artifact in practice—webpack/vite env injection misconfigurations—and demo a quick grep or tool like git-secrets/trufflehog on a sample build output to show how trivially this can be caught before shipping.