# Northflank: Incident silently edited: Security incident

> Incident silently edited: Security incident. Detected 2026-10-30 by Rewindex: what changed on Northflank’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/rd4800fe5a06b2c
Last updated: 2026-10-30T16:13:11Z

**Summary:** _summary pending_
- Kind: Silent edit · Label: not classified yet
- Changed: 2026-10-30 16:13 UTC · Detected: 2026-10-30 16:13 UTC
- [Source: https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp](https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp)
- [Company: Northflank](https://rewindex.com/company/northflank.md)
- Versions: before incident\_version:750/cmvv0rn5a092f14rutwccodpp@4c6ac423948d → after incident\_version:750/cmvv0rn5a092f14rutwccodpp@ef93a5216083
- Change 3 of 6 for this incident

## Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 411 points and 305 comments. [Northflank Breached](https://news.ycombinator.com/item?id=50305025)

_This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. Method: [About: Hacker News signals](https://rewindex.com/about#signals)_
## Discussed on Hacker News

- [Northflank Breached](https://news.ycombinator.com/item?id=50305025): 411 points, 305 comments, posted 2026-10-30 15:10 UTC, posted 90 min after the vendor’s first update
- [Northflank PaaS: Security Incident - Disable/rotate all keys](https://news.ycombinator.com/item?id=50304345): 3 points, 1 comments, posted 2026-10-30 14:21 UTC, posted 42 min after the vendor’s first update

Incident page (full timeline): [Security incident](https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md)
## What changed

**1. Changed: Update** (identified) · 2026-10-30 15:12 UTC

```diff
+ Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that.
  All users should assume their environment variables are…
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-30 14:03 UTC | [Incident updated: Security incident](https://rewindex.com/change/r9b6e9862177929.md) |  |
| 2026-10-30 15:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/rfd65152a228e26.md) |  |
| 2026-10-30 16:13 UTC | Incident silently edited: Security incident (this change) |  |
| 2026-10-30 19:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/r92ee737780c9ce.md) |  |
| 2026-10-30 23:43 UTC | [Incident updated: Security incident](https://rewindex.com/change/r4eacee8745e06c.md) |  |
| 2026-10-31 01:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/r09ce4695b191fd.md) |  |

Previous: [change](https://rewindex.com/change/rfd65152a228e26.md) · Next: [change](https://rewindex.com/change/r92ee737780c9ce.md) · All Northflank changes: [timeline](https://rewindex.com/company/northflank/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/rd4800fe5a06b2c · Markdown: https://rewindex.com/change/rd4800fe5a06b2c.md · JSON: https://rewindex.com/api/v1/changes/rd4800fe5a06b2c · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T07:36:23.135Z