📢 Security Incident Report: Root Cause of Recent Service Disruption

Status: Resolved Date: December 8, 2025

TL;DR:

We recently experienced service instability caused by a cryptocurrency miner installed on our infrastructure. No customer data were accessed or compromised. We have rotated all system secrets as a precaution.

What Happened We detected unauthorized activity on our production server where a cryptocurrency miner was installed. This malicious process aggressively consumed CPU and RAM, killing legitimate application processes to free up resources, which caused the downtime you may have noticed.

Root Cause Analysis Our forensic investigation indicates the likely entry point was a vulnerability in a compromised version of a React Server package used on our blog. We are also investigating and patching potential firewall misconfigurations that may have allowed the initial connection or payload download.

Impact & Data Security The attacker's clear objective was resource theft (mining), not data theft. However, because the intruder had access to the server environment, they theoretically had read-access to environment variables, including:

• Database credentials
• Stripe tokens
• AI provider tokens
• Discord & GitHub tokens

We have found no evidence that these credentials were exfiltrated or used. However, we are operating under a "Zero Trust" model.

Remediation Steps Taken

1. Secret Rotation: We have rotated every credential, key, and token present in the environment.
2. Patching: The compromised React dependency has been removed/updated, and firewall rules have been tightened.
3. Monitoring: We have added strict alerts for high-CPU processes to catch this behaviour instantly in the future.

We apologize for the interruption. Your data remain secure.

Some services may remain unavailable as we work to restore full functionality.