The Federal Trade Commission on Thursday announced an expanded settlement with Uber to address the data breach disclosed by the ride-hailing giant in November, and took the opportunity to urge tech companies to lock down their software development environments.

The new FTC consent order comes after Uber agreed in August to submit to regular audits of its privacy protocols to resolve FTC allegations the company failed to properly safeguard sensitive data. Those allegations had to do with a 2014 data breach that resulted from unsecured data stored on an Amazon Web Services S3 cloud server.

“After misleading consumers about its privacy and security practices, Uber compounded its misconduct by failing to inform the commission that it suffered another data breach in 2016 while the commission was investigating the company's strikingly similar 2014 breach,” acting FTC Chairman Maureen K. Ohlhausen said in a statement.

“The strengthened provisions of the expanded settlement are designed to ensure that Uber does not engage in similar misconduct in the future,” she added. According to the FTC, Uber could be subject to civil penalties for failing to report future breaches under the settlement. Uber is not currently directed to pay any monetary penalty under either consent order.

“My first week at Uber was the week we disclosed the 2016 breach. When Dara Khosrowshahi joined the company, he committed on behalf of every Uber employee that we would learn from our mistakes, change the way we did business and put integrity at the core of every decision we made,” Uber chief legal officer Tony West said in a statement. “Since then we have moved quickly to do just that by taking responsibility for what happened.”

The FTC's chief technologist, Neil Chilson, also posted a blog on Thursday titled “A Lesson from Uber: Secure Your Non-Production Software Environments,” issuing a broader warning to tech companies about how they handle data when collaborating on code.

According to the FTC's complaint, intruders gained access to an Amazon S3 Datastore used by Uber after obtaining an access key an Uber software engineer posted to GitHub, a platform for software collaboration. The key was stored in plain text in a private code repository, but the attackers were able to access it by breaking into GitHub accounts used by Uber engineers. Uber paid the hackers $100,000 to keep the breach quiet.

“Companies often focus their privacy and data security efforts on the up-and-running production environments actively used by their consumers,” Chilson wrote. “But an insecure software development environment can also create real problems. Insecure non-production environments leave a company open to corporate espionage, sabotage by competitors, and, yes, theft of private consumer data.”

Chilson urged companies to “consider privacy and data security in all phases of the software lifecycle.” Specifically, he advised companies to be cautious when submitting code to public or open-source repositories.

“Review it for security vulnerabilities, especially hardcoded keys and logins. Not only does this protect you, your employer, and your customers, it also improves the quality of the code for the community,” he added.