CourseRetrieval-Augmented Generation: The Complete Course · Module 12: Production Engineering · part 88 of 95
Part 88 · Module 12: Production Engineering

Incident: Chat logs open to the internet

8 min read·13 Oct 2026
Module 12 · Incident file · About 30 minutes

What happened

DEEPSEEK'S EXPOSED LOG DATABASE, AS REPORTED 6 Jan 2025 oldest log entry date not given Wiz finds it date not given disclosed, secured 29 Jan 2025 Wiz publishes BleepingComputer, 30 Jan: unknown whether others found it first
The reported timeline: logs ran from 6 January 2025, the exposure (red) was found and secured (green) on dates the sources do not give, and Wiz published on 29 January.

On 29 January 2025 Gal Nagli of Wiz Research reported that Wiz had found "a publicly accessible ClickHouse database belonging to DeepSeek", the Chinese AI company behind the DeepSeek-R1 model (Wiz, 29 January 2025). ClickHouse is an open-source database often used for log storage. Wiz found it "within minutes" of mapping DeepSeek's public subdomains, on two unusual open ports at oauth2callback.deepseek.com and dev.deepseek.com. It was "completely open and unauthenticated": the database's own web page "allowed direct execution of arbitrary SQL queries via the browser".

WHAT AN UNAUTHENTICATED VISITOR COULD REACH open ports 8123 and 9000 ClickHouse no sign-in, SQL log_stream over 1 million rows chat history API keys backend details all of it plain text, as logged
The attack path (red) needed no exploit: an open port, a database with no sign-in, and a log table holding chat text and keys in plain text.

One table, log_stream, held "over 1 million log entries", dating from 6 January 2025. Its columns included "Plaintext logs, including Chat History, API Keys, backend details, and operational metadata". Wiz wrote that an attacker could have retrieved "actual plain-text chat messages" and, depending on the configuration, local files from the server; Wiz says it ran nothing beyond listing what was there. It "immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure". Neither Wiz nor BleepingComputer gives the date of the fix, and BleepingComputer noted that "it is unknown if Wiz's researchers were the first to discover this exposure" (BleepingComputer, 30 January 2025). The sources state no cost, and this file adds none.

The rest of this course is yours to keep

This course is bought on its own, once, and stays readable afterwards, including the parts added to it later.

Buy this course · ₹399See what is inside