ChangesNorthflankSecurity incident
Northflank: Incident updated: Security incident
Summary pending. The diff below shows exactly what changed.
Vendor rated this unknown; a Hacker News thread about it drew 477 points and 361 comments. Northflank Breached (opens in new tab)
This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. How this is computed.
Discussed on Hacker News
- 477 points · 361 comments · posted · posted 90 min after the vendor’s first update
- 3 points · 1 comments · posted · posted 42 min after the vendor’s first update
Threads are matched automatically by vendor name and timing; points and comments refresh every 30 minutes. Method and limits.
Incident page: the full timeline of updates
What changed
Struck in red is what Northflank removed; blue is what they added. Muted text is unchanged context.
Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
How the archive is checked, and what it cannot prove.
Before captured
In the 2026-10-31 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
311758afc2187a69…After captured
In the 2026-10-31 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
066d00b40ff9db95…
History of this incident
TodayMonday, November 2Mon, Nov 2
1 rewrite, 1 incident change
- EditedEdited by the vendor
- Incident updateIncident
Incident updateSecurity incident
Saturday, October 31
4 incident changes
- Normal progressIncident
Incident updateSecurity incidentthis change
- Normal progressIncident
Incident updateSecurity incident
- Normal progressIncident
Incident updateSecurity incident
- Normal progressIncident
Incident updateSecurity incident
Friday, October 30
1 rewrite, 4 incident changes
- Normal progressIncident
Incident updateSecurity incident
- Normal progressIncident
Incident updateSecurity incident
- Normal progressEdited by the vendor
Northflank edited its security incident update to announce secret rotation for Postgres and MongoDB for all users and recommend disabling public expose on addons if enabled. Users are still advised to assume environment variables are decrypted and rotate secrets immediately; multiple users reported their AI keys had been used.
- Normal progressIncident
Incident updateSecurity incident
- Normal progressIncident
Incident updateSecurity incident