The Pulse
Northflank Tells Customers to Rotate Secrets After Security Incident
Northflank warned customers to treat environment variables as compromised and rotate stored secrets after reports of unauthorized use of AI API keys. The company’s status page lists major outages across several platform components, while it
AI.info Team · Written with AI · fact-checked ·
“Assume all environment variables have been decrypted. Disable/rotate all keys.”
Northflank, in its status-page notice
Northflank’s warning: treat stored secrets as exposed
Northflank issued the warning on October 30, 2026, after receiving a threat alert from cloud security company Wiz. The company told users to assume environment variables on its platform had been decrypted and to disable or rotate the keys stored in them. Its guidance covers secrets in workloads, secret groups and global secrets.
Northflank advised customers to revoke exposed credentials with the providers that issued them, create replacements, then update affected secrets and workloads. It also recommended disabling public access to addons where enabled.
Customers report unauthorized AI-key use
In an October 30 update, Northflank said multiple users were confirming that their AI keys had been used. A later update said users had reported unauthorized use of AI API keys supplied to the platform. That update directed customers to review AI-provider usage and billing logs for unexpected activity and report suspicious usage to Northflank support and the relevant provider.
Northflank said on October 30 that its investigation was ongoing and that it had no further confirmed findings to share. Its warning asks customers to assume compromise; it does not establish that every stored secret was accessed or stolen.
Wiz alert precedes patches and credential rotation
Northflank’s timeline begins with a Wiz threat alert at 11:43 UTC on October 30. Northflank engineers reviewed it a minute later, deployed an initial network-policy patch at 12:02 UTC, and added patches at 12:50 and 13:05 UTC. The company requested help from Wiz’s incident-response team at 13:00 UTC.
Northflank later enabled secret rotation for PostgreSQL and MongoDB, then announced on October 31 that rotation for MySQL and Redis was available to all customers. It also enabled audit logs for every customer, including free users. In its latest update, at 1:34 PM UTC on October 31, the company asked customers to rotate all secrets if they had not already.
Wiz offers context, not an attribution
Northflank’s October 30 update said reports of unauthorized key use may fit a broader pattern of attacks targeting AI credentials and noted that similar IP addresses appear in Wiz’s report. Wiz counted at least nine AI developer platforms that had disclosed incidents during October. The report said detailed technical information on most incidents was not available and did not establish that one attacker was behind every case.
Northflank’s status page lists networking, certificates, services, addons, jobs, builds, and logs and metrics as experiencing major outages. The Northflank app and API are listed as operational; the status page does not say the security response caused the outages.
Sentry, a Northflank customer, said its footprint on the platform contains no production infrastructure and that it had found no evidence its customer data or customer-facing services were affected. Sentry said it began rotating secrets and suspending active deployments “out of an abundance of caution,” then reviewed its access logs for all exposed services.
The status page’s October 30, 11:38 PM UTC update contains the instructions to revoke existing credentials with their issuing providers, generate replacements, update affected secrets and workloads, check provider usage and billing logs, and report suspicious activity. The October 31 update focuses on rotating any secrets customers have not already replaced.