Northflank Security Breach Exposes User Secrets
Original: Northflank Breached
Why This Matters
Secrets-in-env breaches signal systemic risk for PaaS platforms handling multi-tenant workloads.
Cloud platform Northflank suffered a security incident on Oct 30, 2026, with attackers decrypting user environment variables. AI API keys confirmed compromised. Users urged to rotate all secrets immediately.
Northflank, a cloud deployment platform, confirmed a major security incident on October 30, 2026, beginning with a Wiz threat alert at 11:43 UTC. Engineers responded within one minute, deploying an initial network policy patch by 12:02 UTC, with additional patches at 12:50 and 13:05 UTC. Wiz's CIRT team was brought in for support at 13:00 UTC.
By 1:58 PM UTC, Northflank issued a stark warning: "Assume all environment variables have been decrypted. Disable/rotate all keys." Multiple users independently confirmed that their AI service API keys had been actively used by unauthorized parties — meaning the breach wasn't just data exposure, but active exploitation.
Northflank subsequently enabled automatic secret rotation for Postgres and MongoDB for all users, and advised disabling public exposure on database addons. The platform's core infrastructure — networking, services, addons, jobs, builds, logs, and metrics — all showed major outages during the incident, while the app, API, and marketing site remained operational.