Nix 2.24.8 released fixing builtin:fetchurl credentials leak, severity 5.9 (moderate)

So the DetSys tweet was an accidental leak?

Not quite, builtin:fetchurl: Enable TLS verification by edolstra · Pull Request #11585 · NixOS/nix · GitHub had been publicly merged and Nix 2.24.8 has been released at that point.