上周國外多家媒體報導，在 Github 內部的日誌系統中，部分用戶的密碼以明文的形式暴漏給了內部員工。
經整理，事件始末如下：
Github 上周二向部分用戶發送了一封電子郵件，通知由於密碼重置功能出現故障，導致其內部日誌明文記錄了某一時間段用戶在進行密碼重置時的密碼。目前 Bug 已修復，但這一部分的用戶需要再次重置密碼才能訪問帳戶。
郵件中，GitHub 還表示這些密碼大多數 GitHub 員工是無法訪問的，更不會被公眾或其他 GitHub 用戶訪問到。GitHub 不會故意以明文格式存儲密碼，也沒有被黑客入侵或以任何方式洩密。
郵件全文如下：
During the course of regular auditing, GitHub discovered that a recently introduced bug exposed a small number of users' passwords to our internal logging system, including yours. We have corrected this, but you'll need to reset your password to regain access to your account.
GitHub stores user passwords with secure cryptographic hashes (bcrypt). However, this recently introduced bug resulted in our secure internal logs recording plaintext user passwords when users initiated a password reset. Rest assured, these passwords were not accessible to the public or other GitHub users at any time. Additionally, they were not accessible to the majority of GitHub staff and we have determined that it is very unlikely that any GitHub staff accessed these logs. GitHub does not intentionally store passwords in plaintext format. Instead, we use modern cryptographic methods to ensure passwords are stored secure in production. To note, GitHub has not been hacked or compromised in any way.
You can regain access to your account by resetting your passwords using the link below::
https://github.com/password_reset
最初，許多用戶在收到郵件後以為這是一個大規模的網絡釣魚攻擊，並在 Twitter 上曬起了截圖。之後才確定是官方發送的郵件，也因此引起了許多媒體的關注和報導。
更多關於此事件的詳細報導請看國外媒體：gizmodo、zdnet、whatsnew2day