Northflank hacked, all env vars stolen; key-hoarding platforms are supply-chain magnets
andersonbcdefg · x · 2026-10-31
After Railway, TiDB Cloud, and OpenCode, deployment platform Northflank was breached with all environment variables (including API keys) stolen. The quoted thread argues these are competent teams — the common factor is that they centralize enormous numbers of keys, making them high-value amplification vectors where one breach hits many downstream targets.
Current defensive tooling isn't good enough for small teams against this level of focused attention; the practical meta is to avoid amplification vectors — services run by small teams that expose many downstream targets are hacker magnets.
The post also links cve.now, a free CVE feed built for agents: it merges CVE List, OSV, GitHub Advisories, and NVD, offers RSS and MCP access, labels model-written summaries, and tracked 16 critical vulnerabilities in the past week.
More from coding & agent
- One prompt: Claude builds a 2,616-line disassemblable robot octopus in three.js — jnack · 2026-10-31
- dotey ships DeepSeek Harness plugin so Claude Design runs on DeepSeek with comment-based iteration — dotey · 2026-10-31
- Claude Code v2.1.316 adds ultrathink toggle, pooled team budgets, deprecates Opus 4.8 fast mode — ashwin-ant · 2026-10-31
- Hobbyist builds an MCP server so Claude can draw working circuit diagrams in under an hour — rballonline · 2026-10-31
- Peter Yang builds a Grok-powered reply-bot filter for X, plans to open-source it — petergyang · 2026-10-31
- Three.js merges Nanite-style meshlet pipeline, rendering 1B triangles at 150FPS — anselm · 2026-10-31