Act
active
Zeabur dev platform shuts down after second breach; 3.2M env vars stolen
- Engineer — Act: If Zeabur was used in any environment — dev, staging, or prod — treat all environment variables stored there as compromised and rotate them immediately, prioritizing database credentials, API keys, and cloud provider tokens.
- SOC/IR — Learn: No IOCs, TTPs, or detection-ready artifacts are published; the breach offers a case study in plaintext credential storage risk but yields no immediate hunt or detection work.
- Leader — Act: Scan your developer tooling inventory for Zeabur usage; if found, confirm the scope of exposed secrets, trigger a credentials rotation sprint, and note that the vendor is shutting down — no incident report will be forthcoming after closure.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.