Northflank update: protect the connections your app uses

Start with the person who runs your app

If your app runs on Northflank, contact the person responsible for its connected services today. Ask them to follow the company's current instructions for replacing stored access keys and checking unusual spending. Northflank hosts apps and the services they depend on.

An access key, often called an API key, lets an app use another service on your account. Think of an app that sends a question to AI and pays for the answer. Revoking a potentially exposed key disables that old route into your account.

Read the announcement: Northflank: incident updates, including November 2 at 11:09 UTC.

What the latest update says

Northflank first disclosed the incident on October 30. In its November 2 update at 11:09 UTC, the company said the attack appeared contained within an hour of the first alert. Independent investigators are still reviewing what happened.

The company reports no sign that running apps or their data were accessed. It says the evidence points to stored secrets, the private credentials used to connect services. Customers with dedicated or forward-deployed control systems are unaffected, according to the update.

Some customers have reported unauthorised AI use. Northflank still asks affected customers to replace both integration and project credentials, even without suspicious activity. That is an action request, not confirmation that every customer lost data or money.

Make the follow-through visible

Changing a value in an app setting alone does not necessarily disable the old key. Northflank's instructions say to revoke credentials with the provider that issued them, create replacements and update the app. Check usage and billing records too.

For some database add-ons, Northflank's replacement process can leave old credentials valid until the process is completed. Ask your builder to confirm that final step. Its secret-group guidance also explains how to restart connected services with updated values.

1. List the services your app connects to and the person who controls each account. Record names and owners, never the secret values in a shared document.
2. Have the responsible person follow Northflank's current response instructions and each provider's replacement process. Confirm the old access is disabled.
3. Ask them to check the app still works, review unusual charges and report suspicious use to Northflank and the relevant provider.
4. Keep a dated record of what was checked and what still needs attention. If ownership is unclear, contact Northflank support.

A useful skill for your next build

For people learning to build with AI, this is a practical lesson in ownership. Knowing who can replace an app's keys matters alongside knowing how to build its screens. You can practise that handover on a separate test app with a limited test account.

Northflank's security guidance recommends granting only the access a person or app needs and keeping secrets out of saved project code. Ask for those decisions to be explained when you build with someone. They should be understandable without reading the code.

The reported misuse can leave people with real bills and extra work. Clear account ownership and a checked replacement process are useful ways to respond. They also give you a better set of questions to bring into your next app project.