Velox DataEngineering & human things
English
Menu

Which Keys to Rotate After the Zeabur Security Incidents: Checklist and Order

Zeabur had security incidents in August and October. Which keys to replace, in what order, and a pitfall we found in testing: restoring a Zeabur backup brings the old database password back.

Elian Lu · Velox Data ·

Key points

  • Assume every environment variable on Zeabur has leaked: rotate payment, AI API, cloud account and email-service keys today.
  • For everything else, create new keys on the new platform, confirm it works, then revoke the old ones.
  • Restoring Zeabur's data.sql sets the database password back to the old one; change it after the restore.
  • Uninstall the Zeabur GitHub App only after everything has moved.
How was this verified? (1 tested, 2 from official docs)
Tested ourselves
  • Zeabur's PostgreSQL backup format (a pg_dumpall data.sql) contains ALTER ROLE ... PASSWORD, so a restore brings back the old password (tested in Docker)
Written from official docs, not run ourselves
  • Details of the two incidents: from press reports and Zeabur's announcements; Zeabur has not published the full scope
  • Where each provider's revoke and regenerate buttons are: dashboards change, so check each provider's console
Contents (4 sections)
  1. Assume every environment variable has leaked
  2. Order: first the keys that cost money, the rest during the move
  3. A pitfall we found: restoring the backup restores the old password too
  4. Wrapping up after the move

Assume every environment variable has leaked

On 8/28 Zeabur announced that environment variables of some projects had been accessed without authorization, including common credential types such as “API keys, database connection strings and cloud service keys” (as relayed by CodeCat). Zeabur shipped a security upgrade on 9/7; a larger incident followed on 10/14, after which it announced the shutdown.

We can’t know whether your data was affected, so the safe assumption is: replace every key stored in your Zeabur environment variables.

Order: first the keys that cost money, the rest during the move

Rotate today: keys that cause direct financial loss if leaked.

TypeExamplesAfter rotating, check
PaymentsStripe secret keys; ECPay/NewebPay HashKeys (Taiwan)Recent transactions and refunds
AI APIsOpenAI, Anthropic, Gemini API keysUnusual usage on your bill; set a spending limit while you’re there
Cloud accountsAWS access keys, GCP service account JSON, Cloudflare API tokensResources you don’t recognize
Email servicesSendGrid, Resend, MailgunSending logs (leaked keys get used for phishing)

Rotate during the move: set new keys on the new platform, confirm the new service works, then revoke the old ones. You rotate once and the service never goes down.

  • Database passwords (the new database has a new password anyway, but see the pitfall in the next section)
  • LINE Channel Secret and Channel Access Token; Discord and Telegram bot tokens
  • OAuth client secrets for Google and Facebook login
  • JWT/session signing secrets: every user gets logged out once, which is expected
  • Credentials stored in n8n (see the n8n post)

A pitfall we found: restoring the backup restores the old password too

Zeabur’s PostgreSQL backup is a data.sql produced by pg_dumpall. In our test with the same format, the file starts with these two lines:

CREATE ROLE root;
ALTER ROLE root WITH SUPERUSER INHERIT CREATEROLE CREATEDB LOGIN REPLICATION BYPASSRLS PASSWORD 'SCRAM-SHA-256$4096:...';

After restoring into a new database with psql, the root password is back to the old Zeabur password. If that password leaked in an incident, the new database is no safer.

Fix it one of two ways:

  • Before restoring, delete the CREATE ROLE and ALTER ROLE lines from data.sql
  • After restoring, change the password right away: ALTER ROLE root WITH PASSWORD 'a-new-long-password';

Better still, use pg_dump to back up only the database itself, which carries no roles or passwords. Full steps in the database post.

Wrapping up after the move

  • Uninstall the Zeabur GitHub App: GitHub → Settings → Applications → Installed GitHub Apps → Zeabur → Uninstall. Wait until everything has moved, or your Zeabur services can no longer redeploy
  • SSH keys on dedicated servers: if you added SSH public keys to a Zeabur dedicated server, use a fresh key pair on the new machine
  • Delete your data on Zeabur: once your backups are safely in your hands, delete services, volumes and projects. When requesting a refund, also ask for your account data to be deleted, and keep a written record
  • Keep evidence: save screenshots of bills with unusual charges; you’ll need them for a security-incident compensation claim (see the refunds section of the guide)