Zeabur Security Incident Explained: API Key Leak Review and Lessons Learned
A breakdown of the August 2026 Zeabur security incident, covering how OpenAI, AWS, and other API keys were leaked, the official response, and the immediate steps users should take.
On August 27, the cloud deployment platform Zeabur suffered a security incident: an unauthorized party gained access to an internal service credential used to retrieve project environment variable records, and used it to obtain some users’ environment variables. According to what Zeabur disclosed, the exposed environment variables included API keys for AI tools such as OpenAI and Anthropic, as well as GitHub PATs and AWS-related credentials. What an attacker can actually do with a leaked key depends on the permissions granted to it — in this case, some victims’ keys were used by attackers, with the resulting bills charged to the original account owners.
What happened
- Aug 27: An internal Zeabur service credential was accessed without authorization
- The attacker used this credential to obtain users’ environment variables
- Types of leaked credentials: OpenAI / Anthropic / OpenRouter / GitHub PAT / AWS / Cloudflare / Stripe tokens (see the official status page for details:
)
- It has been confirmed that some users’ AI API keys were abused (unusual billing)
Investigation leads
The official status page disclosed suspicious activity on LiteLLM, the service used by Zeabur AI Hub. Whether this activity is related to the incident is still under investigation. Although unconfirmed, as a precaution and to prevent any further potential impact, Zeabur has temporarily suspended the Zeabur AI Hub service during the investigation.
How the founder responded
Founder Yuan-Lin Lin posted an update on Threads on Aug 29:
- Initial containment was completed the same day the anomaly was detected
- Continued monitoring for further anomalies
- Notifying all potentially affected users individually and publishing announcements
- Cooperating with upstream vendors and law enforcement on further investigation
Users are urged to immediately rotate all API keys and passwords stored on Zeabur, and check usage and billing. If abuse is found, keep evidence such as timestamps, amounts, token usage, and source IPs, and submit them to support. 
If you’re a Zeabur user, here’s what to do now
- Immediately rotate all keys and passwords stored in Zeabur environment variables
- Check billing for every service and associated API key used with Zeabur
- If you notice unusual usage, take screenshots as evidence and submit them to Zeabur support
- Rotate database passwords, JWT secrets, and any other credentials as well
Lessons learned
Set usage limits
Regardless of the platform you use, remember to set usage limits or budgets.
Principle of least privilege
Since the rise of cloud computing, platforms have repeatedly urged following the principle of least privilege — restricting permissions limits the blast radius of any breach. Now that AI tools are widely used by the public, the same principle applies to API usage.
Consider Federated Authentication
In recent years, many platforms have moved away from long-lived keys toward system-to-system Federated Authentication (e.g., OIDC), which uses short-lived credentials and fine-grained trust relationships to restrict access scope. This can significantly reduce the risk of abuse after a credential leak.