HackerOne

LastPass's third breach notice didn't come from its own servers. A vendor called Klue — a CRM-attached "market intelligence" platform for sales teams — got compromised, exposing LastPass customer names, phone numbers, emails, and physical addresses. Encrypted vaults were untouched.

On HN the pile-on was instant. But the sharpest comment cut the other way: a security engineer noted every sales org has a dozen of these tools wired in, and the only surprise is that this kind of breach doesn't happen far more often.

The HackerOne form and security email go dark July 1 to August 3, and the 8.22.0 release slips two weeks to September 2. Daniel Stenberg's reasoning is plain: the team is burnt out and needs rest.

The thread half-celebrates, half-worries about one loophole: paid support clients can still pressure for a fix if someone discloses publicly during the freeze — and curl, for all its ubiquity, has no second on-call human.