Trigger.dev
An attacker gained access to environment variables for a subset of organizations.
What to do: Trigger.dev emailed the account owners affected, with steps to take. Check that inbox.
$ Platform incidents
Security incidents at developer and AI platforms, with what to do. We list what each company has said, and link the source. This list isn't complete, so also check your platform's status page.
Rotating a secret means revoking it where it was issued. Deleting it from the platform doesn't invalidate it.
Northflank
Northflank told customers to assume all environment variables were decrypted. Customers reported unauthorized use of AI API keys.
What to do: Rotate every secret stored on the platform, disable public access to add-ons, and check AI provider usage and bills.
Chainstack
Attackers reached development and production systems. Account details and password hashes may have been exposed, and Chainstack is treating node credentials as exposed.
What to do: Change your Chainstack password and anywhere you reused it, rotate node credentials, and regenerate platform API keys.
Warp
A breach at a third-party vendor exposed AI agent logs and telemetry. Warp's CEO estimated about 1% of users, and Warp hasn't said whether the logs held code or credentials.
What to do: Warp hasn't published steps for users. As a precaution, if you used its agent features, rotate any credential that could have appeared there.
Railway
An attacker reached encrypted customer environment variables and decrypted some. Railway's estimate is at most 1.85% of workspaces, and its investigation was still open at its last report.
What to do: Railway advises everyone who signed up before 21 October 2026 to rotate secrets stored on the platform, and to check GitHub and registry audit logs.
OpenCode Console
An intruder reached a legacy system, which may have exposed provider keys saved in the hosted Console for about 1.4% of its users. The CLI and desktop apps are separate from the Console.
What to do: OpenCode emailed the users affected. If you got that email, revoke and replace those keys with each provider, and check your bills.
Lightning AI
Unauthorized access to credentials affected Studio, Deployments, Pipelines and Drive. Lightning believes some customer credentials were used to reach connected services.
What to do: Rotate secrets and API keys stored in your AI Studio environment, and review access logs of connected services. Lightning advises this even if it didn't contact you.
Zeabur
Long-lived admin credentials leaked, exposing about 3.2 million environment variable records and 321,810 account records. Zeabur says it's shutting down.
What to do: Replace every password and key stored on Zeabur, revoking old ones with each provider first, and change database passwords inside the database.
Andromeda
Some Andromeda and customer credentials were accessed, in a limited number of customer accounts.
What to do: Andromeda says it contacted the customers affected, and has rotated affected keys.
Fireworks AI
A third party accessed environment variables used in evaluation jobs, in a limited number of customer accounts.
What to do: Fireworks emailed the customers affected. If you got a notice, replace your API keys and rotate the listed credentials with their providers.
Vercel
An attacker used a compromised third-party AI tool to reach Vercel systems and read non-sensitive environment variables for some customers. Vercel has since closed the incident.
What to do: Rotate non-sensitive variables that hold API keys, tokens or database credentials, and mark secrets as sensitive.