In March 2023, Twitter found that parts of its proprietary source code and internal tools had been posted publicly on GitHub, apparently for months, by a user called "FreeSpeechEnthusiast". Twitter filed a copyright takedown notice, and GitHub removed the repository on Friday 24 March 2023. The same day, Twitter asked a US federal court for a subpoena to make GitHub reveal the identity of the uploader and of anyone who had posted, uploaded, downloaded or modified the code; the court granted it days later. According to The New York Times, as reported by BankInfoSecurity, Twitter's investigation pointed to someone who had left the company the previous year. No credential abuse or secret exposure has been reported, which is why this case is listed as a human insider incident rather than an NHI breach.
Key takeaways
- Proprietary source code for Twitter's platform and internal tools was posted to a public GitHub repository by the user "FreeSpeechEnthusiast", whose account was created on 3 January 2023.
- The code appears to have been public for months before Twitter spotted it; GitHub removed it on 24 March 2023 after a DMCA notice.
- Twitter sought a subpoena for the uploader's identity and for everyone who accessed, downloaded or modified the code, and a California court granted it.
- Reports linked the leak to a former employee; no stolen credentials or exposed secrets have been reported.
- The identity lesson: when people leave, their access to code must go with them, and any secrets in that code should be treated as exposed if it leaks.
At a glance
| Organisation | Twitter (now X) |
|---|---|
| When | Code posted after 3 January 2023, apparently public for months; removed 24 March 2023; subpoena granted 28 March 2023 |
| Attacker | GitHub user "FreeSpeechEnthusiast"; reported to have left Twitter the previous year |
| Entry point | Insider access to Twitter source code, published to a public GitHub repository |
| Identities abused | No machine credentials reported; the leak relied on a person's access to code |
| Impact | Partial Twitter platform source code and internal tools exposed publicly; number of downloads unknown |
| Category | Human identity (not listed as an NHI or AI agent breach). Incident class: human insider source code leak |
What happened
On 24 March 2023, GitHub complied with a Digital Millennium Copyright Act notice from Twitter and removed a repository containing "proprietary source code for Twitter's platform and internal tools." The repository belonged to a user with the handle "FreeSpeechEnthusiast". According to CNN, the account was created on 3 January and did not appear to have posted anything else. BleepingComputer, citing The New York Times, reported that the code "appeared to have been public for at least several months."
In its takedown notice, Twitter asked GitHub to "preserve and provide copies of any related upload / download / access history (and any contact info, IP addresses, or other session info related to same), and any associated logs related to this repo or any forks thereof." It then filed for a subpoena in the US District Court for the Northern District of California, seeking all identifying information for the account and for "the users who posted, uploaded, downloaded or modified the data." The Register reported on 29 March that the court had granted the request, giving GitHub until 3 April to respond. Twitter's lawyer confirmed the code was not covered by an open source licence.
BankInfoSecurity, citing The New York Times, reported that Twitter's investigation had found the user or users left the company the previous year. The leak came months after Elon Musk bought Twitter and laid off a large share of its staff. It is not known how many people downloaded the code before it was removed, or whether it contained any credentials. Twitter did not respond meaningfully to press questions; CNN received an automated reply.
Timeline
| Date | Event |
|---|---|
| 3 January 2023 | The GitHub account "FreeSpeechEnthusiast" is created. |
| 24 March 2023 | GitHub removes the repository after Twitter's DMCA notice; Twitter files for a subpoena. |
| 27 March 2023 | The leak is widely reported after The New York Times breaks the story. |
| 28 March 2023 | A California court grants Twitter's subpoena request, according to The Register. |
How it happened: the identity attack path
- Insider access to code. Someone with access to Twitter's source code, reportedly a former employee, obtained copies of it.
- Public posting. The code was uploaded to a public GitHub repository under a pseudonymous account created in January 2023.
- Months of exposure. The repository stayed public, apparently for months, until Twitter noticed it.
- Legal takedown. Twitter used a DMCA notice to remove the code and a subpoena to identify the uploader and downloaders.
Impact
- Confirmed: partial source code for Twitter's platform and internal tools published without permission.
- Unknown: how many people downloaded or forked it, and whether it contained secrets.
- Risk: CNN and BleepingComputer noted that leaked code lets attackers look for exploitable flaws.
What this means for NHI governance
This leak was made by a person, not a machine identity, so it is not listed on our NHI breach hub. It still carries an NHI lesson. Source code is where secrets tend to hide: API keys, service credentials and tokens committed over years. When code leaks, as the Twitch breach showed with thousands of secrets, every credential in it has to be treated as exposed.
Two controls matter most. Access to source code must be removed promptly when people leave, including personal copies on unmanaged devices where possible. And secrets should never live in code, so a leak exposes logic rather than keys. See our Joiner-Mover-Leaver Guide and Insider Threat and Identity Guide.
Recommendations
- Remove code access at departure. Revoke repository access, tokens and SSH keys the same day someone leaves. See the Joiner-Mover-Leaver Guide.
- Watch for unusual cloning before departures. Bulk downloads by people who are leaving are a known insider signal. See the Insider Threat and Identity Guide.
- Keep secrets out of code. Then a code leak exposes logic, not credentials. See our Secrets Management Guide.
- Monitor public code hosts for your code. Search for distinctive strings from your codebase so leaks are found in days, not months.
- Scan and rotate after any leak. If leaked code contained credentials, rotate them immediately.
Frequently asked questions
Was Twitter's source code leaked?
Yes. Parts of Twitter's source code and internal tools were posted on GitHub by a user called "FreeSpeechEnthusiast" and removed on 24 March 2023 after a DMCA notice.
Who leaked Twitter's source code?
The uploader has not been publicly named. The New York Times reported that Twitter's investigation pointed to someone who had left the company the previous year, and Twitter obtained a subpoena to identify them.
Is the Twitter leak an NHI breach?
No machine credentials or secrets were reported as abused, so we classify it as a human insider incident. It is included because source code leaks often expose embedded secrets.
Related NHI Mgmt Group resources
Twitch Breach 2021 · New York Times Breach 2024 · Insider Threat and Identity Guide · Joiner-Mover-Leaver Guide · Secrets Management Guide
How NHI Mgmt Group can help
Leaver processes often cover email and laptops but miss code access, tokens and keys. We help teams connect human offboarding to the credentials and repositories people can reach. See our NHI and AI agent security training.
References
- BleepingComputer: Twitter takes down source code leaked online, hunts for downloaders (27 March 2023)
- CNN: Twitter says portions of source code leaked online (27 March 2023)
- BankInfoSecurity: Twitter Says Source Code Leaked on GitHub, Files Subpoena (March 2023)
- The Register: Judge grants subpoena to ID Twitter source code leaker (29 March 2023)