Customers of the domain registrar Namecheap received a wave of phishing emails in February 2023 sent from the company's own address. BleepingComputer reported that the messages impersonated DHL and the cryptocurrency wallet MetaMask and originated from SendGrid, the email platform Namecheap used for renewal notices and marketing emails.

Richard Kirkendall, Namecheap's CEO, said the company disabled email through SendGrid while it investigated and that the incident may relate to an earlier report of API keys for Mailgun, MailChimp, and SendGrid being exposed inside mobile apps. Twilio, which owns SendGrid, told BleepingComputer the incident was not the result of a hack of its systems.

An email API is the connection an application uses to send messages through an email provider automatically. An API key is the long string of characters proving that a request comes from an authorized account, so anyone holding it can send as that account until it is removed. Healthcare apps use the same mechanism, and Paubox describes its own Email API as built for developers sending PHI in transactional emails, the automated messages an app sends after a user takes an action.

Read more: The 5-minute guide to Paubox Email API | Why healthcare businesses choose Paubox Email API | The software developer's guide to HIPAA email APIs

 

Why mail sent with a stolen key looks legitimate

Organizations publish records that tell receiving mail servers which services may send on their behalf. One of these, Sender Policy Framework (SPF), verifies that a provider's servers have been approved to send for a domain.

A message sent with a genuine API key travels through that approved provider, so it reaches recipients from the organization's real sending platform. BleepingComputer's account placed the origin of the Namecheap phishing at SendGrid, the same platform the company used for its own customer notices.

 

How keys end up exposed

Researchers at North Carolina State University carried out the first large-scale study of secrets leaked on GitHub, the most widely used site for sharing source code. Their NDSS Symposium paper found secret leakage affecting more than 100,000 repositories, with thousands of new, unique secrets leaked every day.

Over nearly six months, the team scanned public code changes as they were posted, and it also examined a snapshot covering 13% of open-source repositories. The full paper explains that deleting a key in a later change does not remove it, since the earlier version can still be recovered from the project's history. A leaked key therefore has to be removed in the provider's account and replaced with a new one.

Mobile apps are another route. The Namecheap case pointed to keys written directly into apps that anyone can download and take apart.

 

What else a key can reach

Paubox lets administrators view sent emails in the mail log and receive delivery data through webhooks, which are automatic notifications pushed to an application when something happens. Email providers commonly attach records like these to the same account that sends the mail.

Where those records contain protected health information, unauthorized access raises a HIPAA question. HHS presumes that an impermissible use or disclosure of protected health information is a breach unless the organization can show a low probability that the information was compromised.

 

Limiting what a single key can do

Paubox lets customers generate multiple API keys for different applications. With a separate key for each application, one exposed key can be revoked without taking other systems offline, and the mail log shows which application sent each message.

The Paubox account where keys are created and removed supports authentication beyond a username and password. Every message sent through the HIPAA email API is encrypted, and Paubox signs a business associate agreement, the contract committing a vendor to protect patient data, with every account.

AI tools that send email through Paubox connect via the Paubox MCP server, which holds the API key in its own process and never passes it to the AI model. MCP, short for Model Context Protocol, is the standard that lets AI assistants call outside tools.

Learn more: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

What developers reported about leaked secrets

A follow-up study presented at USENIX Security 2023 surveyed and interviewed developers about how they handle secrets in code. About a third reported experiencing secret leakage in their own repositories, covering both public projects and those restricted to internal use.

The published paper identified 18 approaches developers use to prevent or remediate leaks, ranging from automated secret scanners to changes in where projects store credentials.

 

FAQs

What is an email API key?

A credential an application uses to prove it may send email through a provider's account. Anyone who obtains the key can send messages as that account until it is revoked.

 

Can phishing sent with a stolen key pass email authentication?

It can, because the message travels through the provider the organization has already approved to send for its domain. In the Namecheap incident, the phishing came from the company's real sending platform.

 

Is deleting a leaked key from source code enough?

No. Earlier versions remain in the project's history, so the key needs to be revoked in the provider's dashboard and replaced.

 

Can a leaked key expose patient data?

It can if the key allows access to message logs or delivery data containing protected health information. HHS presumes an impermissible disclosure of PHI is a breach unless the organization shows a low probability of compromise.

 

How does Paubox limit the damage from one leaked key?

Customers can create separate keys for different applications, revoke one without affecting the rest, and protect the account where keys are managed with authentication beyond a password.