Be careful, do not use the link on their account at the moment

I messaged CEO + CTO, and posted on the forum, this attack seems very targeted, only started after everyone is offline, fake website was well done.

I'm waiting for confirmation that nothing else was breached in fly.

We know, we knew within 45 seconds of it happening, we know exactly how it happened, the impact is limited to this dumb Twitter account, the last bits of resolving this involve working X.com, we'll say more later.

Do we need to rotate env vars and change passwords too or is it limited to those that logged into the fake website?