bitbucket private repo code is exposed !

[Naim Bijapure]

We have deployed our code from the bitbucket pipeline to aws ec2. 

recently client received an email from AWS support that the bitbucket code was being exposed. 

anyone from the link can see any files like dotfiles and respective files. 

the link looks like this : 

https://bitbucket.org/abcTech/%4sfasdfasdfasdfasdfadddsafasdf%7D/raw/master/apps/api/.env

this is not a real link. but when I click the link that I received it will show all the content from the file even if you are not a Bitbucket user!

didn't understand what is happening. what could be the issue? 

my guess is the link is generated from the bitbucket pipeline's artifact but how can it be accessible to anyone? 

[Theodora Boudale]

Hi @Naim Bijapure,

The URL you posted here looks like it is from a file that is committed to a Bitbucket Cloud repo. If this can be accessed by anyone, then the repo must have been set to public.

If you are an admin of the repo, you can

1. Open this repo on Bitbucket Cloud website
2. Go to its Repository settings from the left sidebar
3. You will see a checkbox with the text This is a private repository. If that is indeed unchecked, you will need to check it in order to make the repository private.

If you don't have admin access to the repo, you can ask one of the admins to follow the steps I shared.

Please feel free to let me know how it goes and if you need anything further.

Kind regards,
Theodora

[Naim Bijapure]

can anyone answer please ?