IPs leaked in logs
or so it looks to me eg. https://verification.f-droid.org/buildbot/#/builders/1/builds/27696
in all the logs I see
SSH_CLIENT=XXX.XXX.XXX.XXX REMOTEPORT SSHPORT
SSH_CONNECTION=XXX.XXX.XXX.XXX REMOTEPORT YYY.YYY.YYY.YYY SSHPORT
you can easily check if those are real or not, but since we will need to make build logs public, these should not end up there