What went down (short version)

Cloud app host Northflank discovered a security incident where secrets stored on its platform were likely exposed. After a tip from a cloud security firm, Northflank warned customers to rotate all credentials immediately — especially anything that looks like an API key or token.

In plain English: developers often stash sensitive stuff like database passwords, tokens, and AI service keys in environment variables. That stash appears to have been decrypted or accessed, and some users later reported unauthorized use of their AI API keys. Northflank rolled out network patches, enabled credential rotation for popular databases, and turned on audit logs to help customers investigate.

Why this matters and what you should do

This isn’t just an isolated oops — it’s part of a string of attacks targeting platforms that host developer environments. Attackers love environment variables because one leaked API key can be used to run huge volumes of AI requests, rack up bills, or even resell access to expensive models.

Here’s a practical checklist (read it, then do it):

  • Immediately rotate any secrets stored on the platform: environment variables, secret groups, global secrets, and workload secrets.
  • Rotate database credentials (PostgreSQL, MySQL, MongoDB, Redis) if you used platform-managed add-ons or connections.
  • Disable public access to add-ons and services unless absolutely necessary.
  • Check your AI provider usage and billing logs for unexpected spikes or unknown endpoints; report suspicious activity to your provider.
  • Enable and review audit logs to trace suspicious actions — even free accounts should turn them on if available.
  • Consider short-lived credentials or secrets management best practices to limit blast radius in future incidents.
  • Assume keys might be compromised until proven otherwise; treat reused keys like they were already stolen.

Big picture: attacks that steal or misuse API keys (sometimes called “LLMJacking” in the wild) can cost you money and reputation. Be proactive — rotate, audit, and stop reusing secrets like cheap candy. If you manage or use a hosted developer platform, this is the kind of wake-up call you don’t want to snooze.