Zeabur, a Taiwan-based one-click deployment platform with more than 100,000 registered users, has disclosed a security incident that may have exposed customer API keys stored in project environment variables. According to Zeabur’s status page and reporting compiled by the security blog lonelysec, some users have already reported unexplained charges on OpenAI, Anthropic, and OpenRouter accounts.
Unauthorized use of an internal service credential
Zeabur said its monitoring system detected unauthorized use of an internal service credential on Aug. 27. The attacker used that credential to connect to a database and query project environment variables stored for users. The company said some of that data may have been taken, including user-defined API keys, access tokens, and third-party credentials.
On its status page, Zeabur classified the incident as "unauthorized access to project environment variable data." At the same time, the company said it has no evidence at this stage that Zeabur account passwords, personal information, server logs, other project files, or credit card numbers were accessed.
lonelysec traces the attack path back to AWS credentials
lonelysec, a security blog written by Bobo, outlined a possible attack chain that began with an AWS administrator credential. From there, the attacker allegedly moved through a shared cluster in Tokyo and a control-plane VPN, then reached the primary database and obtained customer environment variables.
According to lonelysec’s breakdown, the exposed credential set may span a wide range of services, including OpenAI, Anthropic, OpenRouter, AWS keys, GitHub personal access tokens, Cloudflare, Linode, DigitalOcean, Stripe, as well as database passwords and JWT secrets. That helps explain why some users saw abnormal billing on AI services: stolen API keys were apparently used to consume usage quotas on victim accounts.
AI Hub paused; forum claims remain unverified
Zeabur has suspended its AI Hub service after detecting suspicious LiteLLM-related activity. The company also said it will publish a full post-incident report, though that report had not been released at the time of the source article.
Separately, forum posts have surfaced offering what sellers described as a "612GB compressed customer database" and claiming access to source code, GCP owner credentials, and Google Workspace administrator sessions. Those claims remain unverified. Zeabur said it has no "direct evidence" of a large-scale data breach beyond Variables.
Users are being urged to rotate stored secrets
For users who stored credentials on Zeabur, the practical response described in the source is to act on the assumption that those secrets may already be exposed. That means revoking and regenerating API keys and tokens stored in environment variables, including those tied to OpenAI, Anthropic, OpenRouter, AWS, GitHub, and Stripe, then reviewing recent usage and billing records for anomalies and rotating database passwords and JWT secrets.
The incident also highlights a structural risk in one-click deployment workflows: when developers centralize a large number of high-privilege keys on a single platform for convenience, a breach of that platform can turn into a gateway to many other services at once.