Introduction The discovery of a leaked access token earlier this year that could have opened the door to malicious code being injected into one of the world’s most widespread programming languages has shone a light on why the method we use to search for security issues in software matters. The access token, discovered by the JFrog Security Research team in July, had administrator access to Python’s, PyPI’s and Python Software Foundation’s software repositories in software developer platform GitHub. It was leaked in a public Docker container hosted on Docker Hub. The research team, which scans public software repositories for malicious packages and leaked secrets as a service to the coding ...