Zeabur Platform Shuts Down After Second Credential Leak Breach

Zeabur, a cloud‑based development platform, announced it will cease operations following a second major security incident within two months, a breach that exposed more than 3.2 million environment‑variable records and data linked to over 321,000 user accounts.

The latest attack was traced to internal credentials that had been stored in plaintext on the company's servers. Attackers leveraged these leaked keys to gain unrestricted access to Zeabur’s infrastructure, extracting the extensive set of environment variables – the configuration data that often contains API keys, database passwords and other sensitive tokens used by developers.

Zeabur’s first breach, reported earlier this year, prompted an internal review and a public promise to tighten security controls. However, the recurrence of the same flaw – the unencrypted storage of privileged credentials – highlighted deeper deficiencies in the platform’s secret‑management practices and raised questions about the effectiveness of the remedial measures taken after the initial incident.

For the platform’s users, the fallout is significant. Developers who relied on Zeabur for staging and production environments now face the possibility that their application secrets have been compromised, potentially exposing downstream services to further attacks. The company has offered assistance to migrate projects to alternative services, but the decision to wind down operations leaves many customers scrambling to secure their codebases and rotate exposed keys.

The incidents arrive at a time when supply‑chain and credential‑theft attacks are on the rise across the software industry. Security experts stress that storing secrets in plaintext violates basic best‑practice guidelines and that robust secret‑management solutions – including encryption at rest, automated rotation and strict access controls – are essential for any platform handling code and configuration data.

Regulators may now examine whether Zeabur complied with data‑protection obligations, and affected users could pursue legal avenues for damages. While the company has not disclosed its financial status, the shutdown suggests it may be seeking bankruptcy protection or an acquisition. The episode serves as a cautionary tale for cloud service providers about the critical importance of safeguarding the very credentials that power modern development workflows.