Hacker News Reader

It happened again after rolling it, so a dev’s machine is compromised, the prod infra is, or they’re straight serving the key somewhere.

Exactly. If I had to bet I would guess their server is just straight up serving the file. I've seen that way too many times.