Exposed for months They added that they found the token inside a Docker container in a compiled Python file that was erroneously not cleaned up.