> ## Content Index
> Fetch the complete content index at: https://www.kenst.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# OpenAI Emailed Me About a Leak I Didn't Own
- URL: https://www.kenst.com/openai-emailed-me-about-a-leak-i-didnt-own/
- Published: 2026-10-25T19:39:00.000Z
- Updated: 2026-10-25T19:38:59.000Z
- Description: A few weeks ago, I got an email from OpenAI.
- Author: Chris Kenst
- Tags: DevRel, Mailinator

A few weeks ago, I got an email from OpenAI.

It wasn’t about one of my accounts and I didn’t own the repository or the API token involved. I was copied on the email because OpenAI thought I might know who to contact at [Mailinator](https://www.mailinator.com/?ref=kenst.com). I’ve done (and still do) some developer relations work for them. 

According to the email, an OpenAI model found and used an exposed Mailinator API token from a public GitHub repository. The notice called out the Mailinator private domain, making the report actionable without circulating the token itself.

You can read part of the email for yourself:

![](https://storage.ghost.io/c/64/2d/642d9fac-06bc-48ce-a22c-14219bd777e6/content/images/2026/10/Screenshot-2026-10-19-at-4.27.58---PM.png)

OpenAI Email (redacted)

Good job, OpenAI.

I was surprised for two reasons:

1. It’s an unusual email to receive out of the blue.
2. I thought it was cool that the public trail of my work still led someone to me as a plausible route into the company.

I passed the report on to Mailinator who acted on it. Their response was straightforward: rotate the token so it couldn’t be used again. This also prompted me to write a new post on Mailinator’s blog: [Exposed API Token? Here's What to Do Next](https://www.mailinator.com/exposed-api-token/?ref=kenst.com).

An exposed credential should be replaced.

That’s the security story, and it’s a good one.

The part I keep thinking about is how they found me. I checked both ChatGPT and Claude after they reached out. Neither identified me with Mailinator. Maybe a LinkedIn search? Either way, someone inside OpenAI, using whatever information they could find, made a reasonable assumption: I might be able to help.

Former employees and people with loose professional connections shouldn’t become permanent incident-response contacts. (There are few former employers come to mind.) Companies still need clear, monitored contact points. But the formal path isn’t always the path someone can find.

Sometimes a professional identity outlasts a role just long enough to get an important message where it needs to go. Sometimes, that’s enough.