[
  {
    "id": "trigger-dev-2026-11",
    "platform": "Trigger.dev",
    "names": [
      "trigger.dev",
      "trigger",
      "triggerdev"
    ],
    "date": "2026-11-01",
    "summary": "An attacker gained access to environment variables for a subset of organizations.",
    "action": "Trigger.dev emailed the account owners affected, with steps to take. Check that inbox.",
    "audience": "notified",
    "source": "https://status.trigger.dev/incident/1110434"
  },
  {
    "id": "northflank-2026-10",
    "platform": "Northflank",
    "names": [
      "northflank"
    ],
    "date": "2026-10-30",
    "summary": "Northflank told customers to assume all environment variables were decrypted. Customers reported unauthorized use of AI API keys.",
    "action": "Rotate every secret stored on the platform, disable public access to add-ons, and check AI provider usage and bills.",
    "audience": "everyone",
    "source": "https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/"
  },
  {
    "id": "chainstack-2026-10",
    "platform": "Chainstack",
    "names": [
      "chainstack"
    ],
    "date": "2026-10-26",
    "summary": "Attackers reached development and production systems. Account details and password hashes may have been exposed, and Chainstack is treating node credentials as exposed.",
    "action": "Change your Chainstack password and anywhere you reused it, rotate node credentials, and regenerate platform API keys.",
    "audience": "everyone",
    "source": "https://chainstack.com/security-incident-nov-2026/"
  },
  {
    "id": "warp-2026-10",
    "platform": "Warp",
    "names": [
      "warp"
    ],
    "date": "2026-10-23",
    "summary": "A breach at a third-party vendor exposed AI agent logs and telemetry. Warp's CEO estimated about 1% of users, and Warp hasn't said whether the logs held code or credentials.",
    "action": "Warp hasn't published steps for users. As a precaution, if you used its agent features, rotate any credential that could have appeared there.",
    "audience": "notified",
    "source": "https://bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data"
  },
  {
    "id": "railway-2026-10",
    "platform": "Railway",
    "names": [
      "railway"
    ],
    "date": "2026-10-20",
    "summary": "An attacker reached encrypted customer environment variables and decrypted some. Railway's estimate is at most 1.85% of workspaces, and its investigation was still open at its last report.",
    "action": "Railway advises everyone who signed up before 21 October 2026 to rotate secrets stored on the platform, and to check GitHub and registry audit logs.",
    "audience": "everyone",
    "source": "https://blog.railway.com/p/preliminary-report-october-security-incident"
  },
  {
    "id": "opencode-2026-10",
    "platform": "OpenCode Console",
    "names": [
      "opencode",
      "opencode console"
    ],
    "date": "2026-10-17",
    "summary": "An intruder reached a legacy system, which may have exposed provider keys saved in the hosted Console for about 1.4% of its users. The CLI and desktop apps are separate from the Console.",
    "action": "OpenCode emailed the users affected. If you got that email, revoke and replace those keys with each provider, and check your bills.",
    "audience": "notified",
    "source": "https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/"
  },
  {
    "id": "lightning-ai-2026-10",
    "platform": "Lightning AI",
    "names": [
      "lightning ai",
      "lightning.ai",
      "lightning"
    ],
    "date": "2026-10-15",
    "summary": "Unauthorized access to credentials affected Studio, Deployments, Pipelines and Drive. Lightning believes some customer credentials were used to reach connected services.",
    "action": "Rotate secrets and API keys stored in your AI Studio environment, and review access logs of connected services. Lightning advises this even if it didn't contact you.",
    "audience": "everyone",
    "source": "https://lightning.ai/blog/oct-2026-incident"
  },
  {
    "id": "zeabur-2026-10",
    "platform": "Zeabur",
    "names": [
      "zeabur"
    ],
    "date": "2026-10-14",
    "summary": "Long-lived admin credentials leaked, exposing about 3.2 million environment variable records and 321,810 account records. Zeabur says it's shutting down.",
    "action": "Replace every password and key stored on Zeabur, revoking old ones with each provider first, and change database passwords inside the database.",
    "audience": "everyone",
    "source": "https://zeabur.com/blogs/october-2026-security-incident"
  },
  {
    "id": "andromeda-2026-10",
    "platform": "Andromeda",
    "names": [
      "andromeda"
    ],
    "date": "2026-10-09",
    "summary": "Some Andromeda and customer credentials were accessed, in a limited number of customer accounts.",
    "action": "Andromeda says it contacted the customers affected, and has rotated affected keys.",
    "audience": "notified",
    "source": "https://andromeda.ai/security-updates/october-2026-security-incident"
  },
  {
    "id": "fireworks-2026-10",
    "platform": "Fireworks AI",
    "names": [
      "fireworks",
      "fireworks ai",
      "fireworks.ai"
    ],
    "date": "2026-10-06",
    "summary": "A third party accessed environment variables used in evaluation jobs, in a limited number of customer accounts.",
    "action": "Fireworks emailed the customers affected. If you got a notice, replace your API keys and rotate the listed credentials with their providers.",
    "audience": "notified",
    "source": "https://fireworks.ai/security/bulletins/october-2026-security-incident"
  },
  {
    "id": "vercel-2026-04",
    "platform": "Vercel",
    "names": [
      "vercel"
    ],
    "date": "2026-04-19",
    "summary": "An attacker used a compromised third-party AI tool to reach Vercel systems and read non-sensitive environment variables for some customers. Vercel has since closed the incident.",
    "action": "Rotate non-sensitive variables that hold API keys, tokens or database credentials, and mark secrets as sensitive.",
    "audience": "everyone",
    "source": "https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
  }
]