A hosting platform admits its admin credentials sat in plaintext, a solo dev learns his cache mostly serves AI crawlers, and a founder finds a trial abuser who schedules signups like a backup job. One agency posts the boring key hygiene that would have saved a lot of people a lot of money this week.
01
// leaked and stolen credentials
Zeabur: plaintext admin credentials, public admin panels, second incident since August
2 major incidents since August
Zeabur published its preliminary report on the October 14 and 15 incident. An attacker used compromised internal credentials to reach shared clusters, dedicated servers and internal systems, and ended up with read access to the platform database. Zeabur says the root cause is its own: long-lived admin credentials stored in plaintext and management interfaces reachable from the public internet. The same morning it also announced it is winding down, with all dedicated servers and shared clusters shut down by December 31.
If you deployed on Zeabur, rotate every secret you stored there, including ones rotated after August, and rebuild any GCP dedicated server from a clean environment, as Zeabur asks. On your own platform, make admin credentials short-lived and keep management interfaces off the public internet.
02
// AI crawlers
916,342 requests, 8.8% cache hits, and the crawlers are why
124 repeats out of 8,080 URLs in one hour
A solo dev tried to raise his Cloudflare cache hit rate from 8.8% of 916,342 requests in 24 hours. In one hour his origin served 8,080 report URLs, and only 124 were repeats. In one day, on report pages alone, GPTBot made about 88.5K requests, PerplexityBot about 49K, ClaudeBot about 46.7K and Googlebot about 2.8K. His fix was fewer unique URLs: compare links became buttons so crawlers stop minting new ?q= pages, hashed assets got a one year cache, and he purges on every deploy.
Stop handing crawlers infinite URLs: put query-string views behind buttons or POST, and disallow parameter pages in robots.txt. Then rate-limit crawlers at the edge so the long tail never reaches your origin.
03
// free-trial abuse
A free trial abuser with a Sunday cron job
Petar Georgiev, who builds a social scheduling app, says one of his free trial abusers has a cron job that creates accounts every Sunday. His bigger complaint is not the cost but the noise: abusers pollute his growth numbers and active trial counts, which he makes decisions on. He has added new measures and says a no-card free trial is hard to make 100% abuse-proof.
Flag signups that arrive on a schedule from the same device, IP range or email pattern, and tag them so they drop out of your trial and activation metrics. If a trial costs you real compute, ask for a card or a verified phone before the expensive part.
04
// the fix
Five boring rules for API keys, from an agency that hands them to agents
With stolen key stories all over the timeline, Rohan Bhanot posted how his agency, Aros, issues keys to the agents it builds for clients. One key per agent, so a leak shows up as one line on the bill. A hard credit limit on every key, which he notes OpenRouter lets you set per key. Keys live on the machine that runs the agent, never in the repo or the prompt, with a daily spend alert at half the usual amount and a new key whenever someone with access leaves.
Start with the two that are settings, not projects: a hard spend cap per key and a spend alert. Then split shared keys so a leak points at one service instead of all of them.