The bodh tool (documentation, source)’s config.py file, containing OAuth credentials of two consumers (production and local), was world-readable, so that anyone on Toolforge could read the consumer secret and hijack the consumer. I’ve made the file non-world-readable now, but the consumer should still be revoked and a new one be requested instead.