Cloud application platform Northflank told customers on October 30 to treat all environment variables as compromised and immediately rotate credentials while it investigated a security incident. The company posted the warning on its public status page and said its inquiry remained active, with no further confirmed findings available at the time of the update.
The guidance covers secrets stored in application workloads, secret groups and global secret stores. Environment variables commonly carry database passwords, cloud credentials, API tokens and other values applications need at runtime. If an attacker can decrypt or read those values, replacing only one exposed token may leave other routes into a customer's systems open.
Northflank therefore advised users to disable or rotate all keys rather than wait for the investigation to identify a narrower affected set. It also urged customers to turn off public access to add-on services where they had enabled it. That step can reduce the number of internet-reachable systems while teams replace credentials and review logs.
The company said multiple users reported that their AI service keys had been used, an indication that at least some stored credentials may have been accessed by an unauthorized party. The status notice did not quantify the number of affected accounts, identify the intruder or explain the initial entry point. It also did not establish that every customer's environment variables were taken. The instruction to assume exposure is a precaution intended to contain risk under uncertainty.
Northflank enabled secret rotation for PostgreSQL and MongoDB for all users, according to the update. Its public timeline says engineers reviewed an alert at 11:44 UTC, deployed an initial network-policy patch at 12:02 UTC and added more patching at 12:50 UTC. The notice does not provide enough detail to determine which control failed or whether those patches fully removed the attacker's access.
Customers responding to the incident need to consider dependencies as well as individual keys. A safe rotation typically requires creating a replacement credential, updating the workload, confirming the service uses the new value and then revoking the old credential. Teams should also inspect provider-side activity logs for unexpected requests, because a rotated key stops future use but does not reveal what an attacker may already have accessed.
Credentials reused across environments create additional exposure. Development, staging and production systems should have separate secrets and narrowly scoped permissions so that compromise of one application does not automatically unlock others. Short-lived credentials and workload identities can further reduce the useful lifetime of material obtained from a secret store.
Northflank's notice remains the authoritative operational source for customers while the investigation continues. Users should follow later status updates for a confirmed scope and remediation details. Until then, the company's direction is unambiguous: act as though secrets were readable, remove unnecessary public exposure and replace credentials throughout connected workloads rather than relying on an incomplete initial assessment.
