# Zeabur

Published articles for Zeabur.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## The token that never expired: What the Zeabur breach teaches SaaS teams that store customer secrets

DevFeed: [The token that never expired: What the Zeabur breach teaches SaaS teams that store customer secrets](<https://devfeed.tech/articles/the-token-that-never-expired-what-the-zeabur-breach-teaches-saas-teams-that-store-customer-secrets-102783.md>)

Original publisher: [Read original article](<https://workos.com/blog/zeabur-breach-customer-secrets>)

Author: WorkOS

Published: 2026-10-27T00:00:00Z

Content type: article

Language: en

Sources: [WorkOS](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>), [Secure token management](<https://devfeed.tech/topics/secure-token-management.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [Post Mortem](<https://devfeed.tech/topics/post-mortem.md>), [Repository](<https://devfeed.tech/topics/repository.md>)

Tags: [2](<https://devfeed.tech/tags/2.md>), [3](<https://devfeed.tech/tags/3.md>), [admin](<https://devfeed.tech/tags/admin.md>), [breach](<https://devfeed.tech/tags/breach.md>), [cluster](<https://devfeed.tech/tags/cluster.md>), [created](<https://devfeed.tech/tags/created.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [customer](<https://devfeed.tech/tags/customer.md>), [customers](<https://devfeed.tech/tags/customers.md>), [environment](<https://devfeed.tech/tags/environment.md>), [environment-variables](<https://devfeed.tech/tags/environment-variables.md>), [means](<https://devfeed.tech/tags/means.md>), [product](<https://devfeed.tech/tags/product.md>), [saas](<https://devfeed.tech/tags/saas.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [store](<https://devfeed.tech/tags/store.md>), [teams](<https://devfeed.tech/tags/teams.md>), [token](<https://devfeed.tech/tags/token.md>), [variables](<https://devfeed.tech/tags/variables.md>), [zeabur](<https://devfeed.tech/tags/zeabur.md>)

### AI overview

Zeabur says an attacker used a never-rotated cluster admin token and other exposed credentials to reach its platform database and read 3,218,965 customer environment-variable records. The report traces the breach through plaintext, long-lived credentials, broad permissions, shared infrastructure and undetected use of valid access. It recommends inventorying and rotating credentials, limiting each key's reach, separating customer workloads and backups from core systems, and alerting on bulk secret reads and unusual admin activity. For stored secrets, it describes envelope encryption with customer-specific key boundaries and decryption at point of use; keeping an encryption key beside the data defeats encryption. WorkOS Vault is presented as one implementation, with BYOK support, but its API key can still authorize decryption and must be protected. Projects moved to customer-controlled servers were outside the database read's scope.

### Source excerpt

A cluster admin token created in 2024 and never rotated led to 3.2 million customer environment variables being read. What that means if your product stores credentials for your customers.

## Zeabur shutting down after second security breach in two months

DevFeed: [Zeabur shutting down after second security breach in two months](<https://devfeed.tech/articles/zeabur-shutting-down-after-second-security-breach-in-two-months-91349.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/>)

Author: Bill Toulas

Published: 2026-10-20T19:33:02Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>), [hosting](<https://devfeed.tech/topics/hosting.md>)

Tags: [api-keys](<https://devfeed.tech/tags/api-keys.md>), [aws](<https://devfeed.tech/tags/aws.md>), [breach](<https://devfeed.tech/tags/breach.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [clusters](<https://devfeed.tech/tags/clusters.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [customer-data](<https://devfeed.tech/tags/customer-data.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [data-breach](<https://devfeed.tech/tags/data-breach.md>), [database](<https://devfeed.tech/tags/database.md>), [dedicated-servers](<https://devfeed.tech/tags/dedicated-servers.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [developer](<https://devfeed.tech/tags/developer.md>), [encrypted](<https://devfeed.tech/tags/encrypted.md>), [environment](<https://devfeed.tech/tags/environment.md>), [gcp](<https://devfeed.tech/tags/gcp.md>), [incident](<https://devfeed.tech/tags/incident.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [infosec-computer-security](<https://devfeed.tech/tags/infosec-computer-security.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [platform](<https://devfeed.tech/tags/platform.md>), [security](<https://devfeed.tech/tags/security.md>), [security-breach](<https://devfeed.tech/tags/security-breach.md>), [shutdown](<https://devfeed.tech/tags/shutdown.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [windows](<https://devfeed.tech/tags/windows.md>), [zeabur](<https://devfeed.tech/tags/zeabur.md>)

### AI overview

Zeabur says an attacker used leaked internal credentials to access its infrastructure and production database on October 14-15, 2026, exposing information for 321,810 accounts and about 3.2 million environment-variable records. The incident affected shared clusters in nine regions; Zeabur also reported root sign-ins on 101 GCP servers, SSH keys added to 50, and 16 customer disk copies attached to attacker-controlled virtual machines. The company says the credentials may have been obtained in an August breach, but has not confirmed that. It acknowledges plaintext credential storage, incomplete administrator credential rotation after August, and publicly accessible admin portals. Users are urged to rotate exposed secrets, revoke active sessions, and rebuild compromised GCP servers. Zeabur plans to disable renewals and pause shared-cluster services on December 1, 2026, then shut down shared clusters and expire dedicated servers by December 31; possible extra time for data migration has no set timeline.

### Source excerpt

Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]