Twitter says parts of its source code have been leaked online

Portions of Twitter’s source code, the underlying computer code on which the social network runs, have been leaked online, according to a legal filing, a rare and major exposure of intellectual property as the company strives to reduce technical problems and reverse its commercial fortunes under Elon Musk.

Twitter on Friday decided to have the leaked code removed by sending a copyright infringement notice to GitHub, an online collaboration platform for software developers where the code was posted, according to the filing. GitHub complied and removed the code that day. It was unclear how long the leaked code had been online, but it appeared to have been public for at least several months.

Twitter also asked the U.S. District Court for the Northern District of California to order GitHub to identify the person who shared the code and anyone else who uploaded it, according to the filing.

Twitter has launched an investigation into the leak and executives handling the case have assumed the official left the San Francisco-based company last year, two people briefed on the internal investigation said. Since Mr. Musk bought Twitter in October for $44 billion, about 75% of the company’s 7,500 employees have been laid off or quit.

Executives were only recently informed of the source code leak, those briefed on the internal investigation said. One concern is that the code includes security vulnerabilities that could give hackers or other motivated parties the means to extract user data or take down the site, they said.

The exposed source code adds to the challenges facing Mr. Musk’s Twitter. Tech companies often treat this code as a closely guarded secret and don’t share it for fear it could give their competitors an unfair advantage or expose security holes.

But even as tech companies scramble to protect their codebases, they have become ripe targets for opportunists, hackers and others. Last year, a hacking group successfully stole source code from Microsoft and other big companies. And in 2020, star self-driving car engineer Anthony Levandowski was sentenced to 18 months in prison for stealing code from Google as he was about to start a new job. (Mr. Levandowski was later pardoned by then-President Donald J. Trump.)

The public release of Twitter’s code is “concerning,” said Brett Callow, a threat analyst at Emsisoft, a cybersecurity software company. “It makes finding vulnerabilities a little easier and faster.”

For Twitter, the leak also adds to growing structural and financial challenges. Mr. Musk has tried to transform the social network in recent months by cutting costs, trying new features and welcoming back previously banned users. But service outages have increased, while advertisers – the company’s main source of income – have been reluctant to run ads on the site.

The turmoil caused financial damage. On Friday, Mr. Musk told employees in an email that Twitter was worth about $20 billion, down more than 50% from what he paid. He said “radical changes” within the company, including massive layoffs and cost-cutting, were needed to avoid bankruptcy and streamline operations.

“Twitter is rapidly reshaping,” Mr. Musk wrote in the email seen by The New York Times. He added that the company could be considered “a reverse start-up” and that he believed Twitter could one day be worth $250 billion.

Mr. Musk did not respond to a request for comment on Twitter’s leaked code. GitHub declined to comment on the decision to remove the code, but posted Twitter’s takedown request on its website.

The leak comes as Mr Musk promised to release some of Twitter’s code. This month, the billionaire said he would release the code used by Twitter to recommend tweets by the end of March, so it could be viewed by anyone and searched. possible flaws. The process could help Twitter’s code become more secure as people have identified and reported issues with it.

At the same time, Mr. Musk worried about the possibility of leaks and thefts by disgruntled former employees during his mass layoffs. In November, he locked Twitter’s offices and asked employees not to enter during the cuts. In recent months, Twitter has also blocked engineers from making changes to the site’s code ahead of the layoffs, lest someone sabotage the platform on their way out.

“One of the best ways to mitigate insider risk is to keep your employees happy and that certainly hasn’t been the case at Twitter,” Callow said.

The person who leaked Twitter’s source code appears to be called “FreeSpeechEnthusiast” on GitHub, according to Twitter’s legal filing. The user’s screen name appears to refer to Mr Musk, who has called himself a “free speech absolutist”.

The anonymous user’s GitHub profile shows a single contribution to the platform in early January. The profile remains online.

Jack Beg contributed to the research.