CrowdSec source code leak reveals reliability and security concerns
Problem
The recent CrowdSec source code leak has raised concerns about its community support, supply‑chain security, and API key management. Users report missing community blocklists for older Debian packages and high false‑positive rates that led them to abandon the product, questioning its overall reliability.
Pain points
- Community blocklist unavailable for older Debian packages, forcing users to build their own
- High false‑positive rate making the product unusable and leading to abandonment
- Security breach exposing API keys, compromising code integrity
- Reliance on a private SaaS platform with no trusted neutral aggregator
- Concerns about API key management and supply‑chain security
Questions to verify
- Is the community blocklist still available for older Debian packages?
- Does the product team have plans to improve API key management and supply‑chain security?
- Are there any announced roadmaps to address the high false‑positive rate?
Evidence
quote · @Anonymous
Funny to see this after I spent the morning troubleshooting and fixing my crowdsec install on my debian 13 vps. Apparently they stopped supplying a community blocklist to my machine because I'm running the old debian packaged version instead of directly from them (http 500). I had a LLM build a blocklist from publicly available sources rather than tie myself more tightly to their SaaS platform.
quote · @Anonymous
the Tanstack compromise is very likely to have been the leak vector ... appears to have been backdoored to extract an API key with authorization to read the private codebase.
quote · @Anonymous
We implemented CrowdSec for bot/scraping mitigation. The architecture is sound, but it ended up having an unacceptable false positive rate for us. ... After a couple of months of work getting it ready to go I had to turn it off after a couple of days.
Disclaimer: this card is distilled by AI from community discussions as “pain point evidence”. It is a starting point for need analysis and validation, not a “validated market need”. AI has analytical limits; please open the original discussion above to manually verify before key decisions.