Security Incident Post Mortem

GitBook's post mortem says an attacker used an SSO login flaw on 2 November 2026 to create staff sessions, then reached internal repositories, a Cloudflare API key and production secrets through a service account. GitBook disabled the accounts, which took the app offline for about 16 hours, and rotated all secrets. It treats all customer data as exposed, though activity appears aimed at one customer and no content changes were found. The AI-driven attack claim is GitBook's inference, and the details come only from GitBook, with no outside confirmation.