RubyGems CDN cache handed strangers fresh API keys for up to an hour
A Fastly caching flaw in RubyGems.org stored gzip responses to authenticated API key requests, so anyone sharing a CDN edge could fetch a freshly minted legacy key for up to an hour without authentication. Leaked keys could yank gems, add owners, and manage webhooks. Fixed, but rotate tokens.