"accessed by unauthorized party" >look inside "we uploaded it to github"

Mozilla Security Blog
SECURITY
Updated GPG key for signing
Firefox and Thunderbird
Releases
Ben Hearsum
August 10, 2026
Today, we moved to a new GPG signing subkey used to sign certain Firefox and Thunderbird artifacts
(namely Linux tarballs, RPM packages, checksums files) after an unencrypted copy of the previous
subkey was inadvertently committed to a private GitHub repository.
Our review of available audit records found no evidence that the key was accessed an unauthorized
party while it was present in the repository. Access to the repository was limited to a small group within
Mozilla, all of whom already had authorized access to the key through other means.
We have revoked the previous signing key and added safeguards to prevent similar issues in the future.