dcomas

Hey, Diego Comas here, Sourcegraph's Head of Security.

The only email addresses that were exposed were those of users who have accounts on Sourcegraph.com, not those of the installers or users of Sourcegraph self-hosted or cloud instances. Note that sometimes users have accounts on both platforms, though (e.g. for license key management). And as you mention, while we do collect the email addresses of the initial installers of self-hosted instances only, for security, product, and marketing updates per our TOS and privacy policy(https://about.sourcegraph.com/terms/privacy), those email addresses were not exposed since they are not stored on Sourcegraph.com.

I lead security at Sourcegraph and have been overseeing the incident investigation and resolution. To give you more specific details, I can say that we saw that the attacker viewed a page where they would have only seen the first 20 items, and we were able to determine what those were at the time of viewing because of stable sorting.