Northflank, a cloud platform for running software, told users on October 30 to treat every environment variable as compromised. These are settings that often hold passwords and API keys. Its status page says to rotate all secrets, including those in workloads, secret groups and global secrets, and to turn off public access to addons. It also says multiple users are confirming their AI keys have been used.
The page does not give a cause or say whether any secrets were read. It gives no cause for the key use, and Northflank has not linked it to the incident. The page lists events in order without explaining them: a Wiz threat alert at 11:43 UTC, a network policy patch at 12:02, more patching at 12:50 and 13:05, and a call for Wiz's incident team at 13:00. The alert's content is not published. Northflank turned on secret rotation for Postgres and MongoDB. At 7:28 PM UTC it had no new findings.
This is WebPulse's reading. Platforms like this usually store secrets encrypted and decrypt them to hand to running apps, so "decrypted" suggests readable secrets. That would explain why database logins and exposed addons are named. Ask which keys you hold there, and whether your AI providers offer usage alerts.