One admin key that never expired.
That's roughly what it took. Zeabur, a cloud deploy platform, kept long-lived admin credentials in plain text. They leaked, someone used them, and not long after, the company said it was shutting down.
It's all public. Their incident report and shutdown notice tell it in their own words.
It's one story. It isn't a trend, and we're not here to pile on. It still made us pause.
The boring stuff is usually the stuff
When we picture what ends a small company, we tend to imagine something clever: a zero-day, a nation-state, a heist movie.
More often it's quieter than that.
- A key someone made years ago "just for now."
- A contractor who left but still has access.
- A secret that's never been rotated, because nothing ever broke.
None of these are dramatic. That's why they last.
Three questions for this week
You might not need a project, a tool or a consultant to start. You might just need a quiet half hour with these:
- Who still has keys? Think people, apps and old integrations, not just staff.
- Do they expire? If one never expires, is that still on purpose?
- Would you know if one was used? And would you know today, rather than next month?
If the answers come easily, good. That's a house in order. If they don't, that's useful to know too, and it's usually a smaller fix than it feels.
We'll give you what you need to decide.
82/18: AI did the 82% that's boring here. The 18% (the judgment, and what we chose to leave out) is John's.