Northflank disclosed a security incident on October 30 and told all users to assume environment variables had been decrypted and immediately revoke or rotate credentials. The scope covers workloads, secret groups and global secrets, with public addon exposure to be disabled. It enabled Postgres and MongoDB secret rotation for all users, and some customers reported unauthorized use of AI API keys. Official updates instruct users to revoke old keys with their issuing providers, replace them in workloads, and review usage and billing records. A shared root cause or attacker across other platform incidents has not been established.