Zeabur dev platform shuts down after second breach; 3.2M env vars stolen

Wed, 21 Oct 2026 15:56:43 +0000

Engineer — Act: If Zeabur was used in any environment — dev, staging, or prod — treat all environment variables stored there as compromised and rotate them immediately, prioritizing database credentials, API keys, and cloud provider tokens.
SOC/IR — Learn: No IOCs, TTPs, or detection-ready artifacts are published; the breach offers a case study in plaintext credential storage risk but yields no immediate hunt or detection work.
Leader — Act: Scan your developer tooling inventory for Zeabur usage; if found, confirm the scope of exposed secrets, trigger a credentials rotation sprint, and note that the vendor is shutting down — no incident report will be forthcoming after closure.

Developer-Tooling on CuraSec