crates.io security incident: improperly stored session cookies

35 · The Rust Programming Language · April 11, 2025, 8:04 p.m.
Summary
The crates.io team reported a security incident involving the cargo_session cookie, which was being logged to Sentry error monitoring. This cookie holds information identifying logged-in users, potentially allowing impersonation. To mitigate the risk, the team has redacted all cookie values from future Sentry logs and invalidated all user sessions, prompting users to log in again. API tokens remain unaffected.