Saying that no 'secrets' were leaked is effectively burying the lede.
The payout data likely wasn’t ripped from a DB but rather dashboards which customer service or partnerships likely had access to. Tier1 or Tier2 support kinda stuff.
This smells like a stolen backup or maybe network access and http scanning, finding the internal GitHub and maybe a support admin cred that allowed dashboard view.
I would classify that as access to production systems.
The other access rights that come from staff access is either incedential or miss /debt in architecture.
The leak includes source code of multiple active websites and applications that are operated under the umbrella of Twitch/Amazon.
Why would an intern have access to this data?
monorepos are a thing at several companies (e.g. Google).
