Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Access keys minted across users in a burst
Criticalnew- Rule
V-004- Account
- 123456789012
- Where
- account-wide
- First seen
- 2026-09-08
- Last seen
- 2026-09-10 (0 days)
- Verdict
- not rated
What Firekeeper saw
observed on synthetic accounts
Resources
No resource is named on this finding.
Evidence
t/4b1c9e0a-1234-4abc-8def-0123456789ab
Guidance
This rule has no written guidance yet.
Across the last 30 runs
| From | To | Runs | State |
|---|---|---|---|
| 2026-09-12 | 2026-09-12 | 1 | new |
| 2026-08-14 | 2026-09-11 | 29 | no board input for that run |
Decisions on this finding
No decision names this finding.
Not a problem?
Signing one of these quiets this finding. Nothing changes until you sign with your passkey, and it ends on its own date unless someone renews it.