You've probably seen it: a little checkmark or verified badge next to a download. Firefox shows it. Your iPhone shows it. Enterprise software definitely shows it. That symbol tells you "this software actually came from who you think it came from." It's not decoration. It's a cryptographic promise signed with a secret key only the real publisher should have.

Mozilla — the organization behind Firefox and Thunderbird — accidentally put that key on GitHub. The key that proves Firefox updates are real and not malware pretending to be Firefox.

It sat there long enough for anyone to find it.

When you download Firefox, your computer checks a digital signature attached to that file. The signature is created using a secret key that only Mozilla is supposed to have. If the signature matches, your system believes the file is safe and came from Mozilla. If it doesn't match, your system warns you or blocks the install.

This is called GPG signing. It's the same technology that verifies Linux updates, software packages, and security patches across the internet. The private key is supposed to stay private — locked in a secure system, never exposed, never shared.

Mozilla's key ended up on GitHub. Anyone browsing the repository during that window could copy it. With that key, an attacker could sign a malicious file and make it look like an official Mozilla release. Your computer would accept it. Enterprise patch systems would accept it. Security tools would accept it. Because the signature would be real — just attached to the wrong file.

Here's the part that makes this worse: once a signing key is exposed, you can't un-expose it. You can only replace it and hope nobody copied it while it was visible.

Mozilla isn't the first organization to leak signing keys on GitHub — and they won't be the last. In the past 18 months alone:

- CISA, the U.S. agency responsible for protecting critical infrastructure, leaked AWS credentials and internal keys on a public GitHub repo. Issue 8 of this newsletter covered it.

- LiteLLM, a widely used AI proxy tool, had two malicious releases published to PyPI carrying credential-harvesting code — attackers had gained enough access to publish as if they were the real maintainers

- Trivy, a popular container security scanner, was compromised in a way that may have enabled the LiteLLM attack

The pattern is always the same: developer pushes code to a public repository. Secret key or credential gets included by accident. Key sits there — sometimes for minutes, sometimes for months — until someone notices. By then, it's too late to know who saw it.

Mozilla rotated the key and published new signatures. But there's no way to know if someone grabbed the old key during the exposure window. There's no way to prove a negative. The only honest answer is: "We don't think anyone got it, but we can't be sure."

You can't audit Mozilla's security practices. You can't prevent GitHub leaks. But you can change how much damage a compromised update could do to you.

1. Turn on automatic updates only for software you actively use. Every auto-update channel is a trust relationship. If you're not using the software, remove it. Old installations are baggage with permissions.

2. If you run a business, use a patch management system that lets you delay updates by 48–72 hours. Let other people be the canary. If a bad update ships, you'll hear about it before it hits your systems. This applies to browser extensions, desktop software, and mobile apps your team relies on.

3. On your phone, review what apps have "install unknown apps" or "accessibility service" permissions. These permissions let apps install other apps or control your device. They're the mobile equivalent of auto-update trust. Revoke anything that doesn't need it.

4. For your personal devices, check your browser extensions right now. Go to your browser's extension settings and remove anything you don't recognize or haven't used in six months. Extensions update silently. A compromised signing key means a malicious update could arrive with no warning.

5. If you manage software for a team, maintain an internal list of what software is trusted and who approved it. When a signing key gets rotated (like Mozilla just did), you'll know which systems need attention. Without a list, you're guessing.

Maybe it changed settings you didn't approve. Maybe it installed something extra. Maybe it just felt wrong. Reply and tell me what happened. I'm tracking how often users notice problems that security tools miss.

Identity Decoded publishes every week at identity-decoded.com