# Northflank: Incident updated: Security incident

> Incident updated: Security incident. Detected 2026-10-30 by Rewindex: what changed on Northflank’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/rfd65152a228e26
Last updated: 2026-10-30T15:13:02Z

**Summary:** _summary pending_
- Kind: Incident update · Label: Normal progress (rule)
- Changed: 2026-10-30 15:13 UTC · Detected: 2026-10-30 15:13 UTC
- [Source: https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp](https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp)
- [Company: Northflank](https://rewindex.com/company/northflank.md)
- Versions: before incident\_version:750/cmvv0rn5a092f14rutwccodpp@55e4a4734bf8 → after incident\_version:750/cmvv0rn5a092f14rutwccodpp@4c6ac423948d
- Change 2 of 6 for this incident

## Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 443 points and 316 comments. [Northflank Breached](https://news.ycombinator.com/item?id=50305025)

_This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. Method: [About: Hacker News signals](https://rewindex.com/about#signals)_
## Discussed on Hacker News

- [Northflank Breached](https://news.ycombinator.com/item?id=50305025): 443 points, 316 comments, posted 2026-10-30 15:10 UTC, posted 90 min after the vendor’s first update
- [Northflank PaaS: Security Incident - Disable/rotate all keys](https://news.ycombinator.com/item?id=50304345): 3 points, 1 comments, posted 2026-10-30 14:21 UTC, posted 42 min after the vendor’s first update

Incident page (full timeline): [Security incident](https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md)
## What changed

**1. Added: Update** (identified) · 2026-10-30 15:12 UTC

```diff
+ All users should assume their environment variables are decrypted and begin rotation immediately. Secrets on workloads Secret groups Global secrets Multiple users are confirming that their AI keys have been used..
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-30 14:03 UTC | [Incident updated: Security incident](https://rewindex.com/change/r9b6e9862177929.md) | Normal progress |
| 2026-10-30 15:13 UTC | Incident updated: Security incident (this change) | Normal progress |
| 2026-10-30 16:13 UTC | [Incident silently edited: Security incident](https://rewindex.com/change/rd4800fe5a06b2c.md) | Normal progress |
| 2026-10-30 19:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/r92ee737780c9ce.md) | Normal progress |
| 2026-10-30 23:43 UTC | [Incident updated: Security incident](https://rewindex.com/change/r4eacee8745e06c.md) | Normal progress |
| 2026-10-31 01:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/r09ce4695b191fd.md) | Normal progress |

Previous: [change](https://rewindex.com/change/r9b6e9862177929.md) · Next: [change](https://rewindex.com/change/rd4800fe5a06b2c.md) · All Northflank changes: [timeline](https://rewindex.com/company/northflank/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/rfd65152a228e26 · Markdown: https://rewindex.com/change/rfd65152a228e26.md · JSON: https://rewindex.com/api/v1/changes/rfd65152a228e26 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T11:22:45.543Z