Developer Deployment Platform Zeabur Announces Shutdown by Year-End
The developer deployment platform Zeabur has announced it will shut down by the end of the year.
The platform experienced two security incidents in October, where Zeabur-related credentials were stored in plaintext in a configuration repository, and the cluster interface was open to the public with credentials not rotated for a long time.
These incidents led to the leakage of various information from 321,000 users, and sensitive data stored on Zeabur was also stolen by hackers.
From October 14 to 15, attackers used leaked internal credentials to access shared clusters, some GCP dedicated servers, and internal systems, ultimately reading the platform's database; it was confirmed that over 3.21 million environment variable records and 321,810 account details were read, and root access was obtained on 101 GCP dedicated servers, involving 92 users.
After the August incident, some management credentials were not rotated, and the admin token has had no expiration since its creation in January 2024 and was not included in the rotation; attackers also added self-controlled SSH keys on 50 servers and mounted 16 copies of customer disk data. The platform has revoked related credentials, blocked known paths, and announced that some services will gradually cease from December 1, with all dedicated servers and shared clusters shutting down by December 31.
Users need to urgently rotate all passwords, API keys, and sensitive information in environment variables, even if they have rotated since August; funds and resource flow towards data backup, service migration, and credential cleanup, benefiting users who migrate in time and complete key rotation, while projects still relying on unrotated keys or the platform's managed environment variables will be under pressure.
Source: Public Information
ABAB AI Insight
Zeabur operated for about three and a half years, providing one-click deployment services for developers, initially focusing on quickly setting up shared clusters and dedicated servers; there was a breach in August where attackers accessed the internal network through user deployment service vulnerabilities and read environment variables. The platform subsequently rotated some credentials but did not cover all long-term management tokens and plaintext stored keys.
In terms of capital and resource pathways, the platform centralized user environment variables, API keys, and account data in its own database and configuration repository, with internal management interfaces open to the public and credentials not rotated for a long time; the motivation was to reduce operational complexity to support rapid growth, but after the two incidents, the team assessed that the required security investment and responsibilities for continued operation exceeded their capacity, leading to the decision to shut down and arrange for refunds and migration assistance.
This is similar to early small PaaS platforms exiting the market after experiencing continuous leaks due to weak credential management, and is close to the paths of some open-source deployment tools being exploited after exposing management interfaces to the public; the current phase is a transition for developer infrastructure from "quick launch priority" to mandatory key rotation, least privilege, and network isolation.
Essentially, this reflects regulatory changes and a restructuring of governance: shifting from a model of hosting environment variables and long-term plaintext credentials to one where users must manage keys themselves or rely on underlying cloud vendors for isolation; the cause was the platform concentrating sensitive data and management permissions within its own system, while credential rotation and access control did not keep pace, leading to known risks being directly exploited in the second incident.
ABAB News · Cognitive Laws
Plaintext credentials + public interface = continuous leaks
Partial rotation equals no rotation
From rapid hosting to mandatory isolation is the exit point for infrastructure