Hug ops to the team. Justin is great and I know they have to be stressed from all of this.

Email I got from Porter follows, trimmed for HN character limit. Full text at https://gist.github.com/leetrout/2d172d2b95e8d24af0f3de0d0b03561e

---

What happened

On April 13th, 2026, the Porter team detected unauthorized activity originating from a stale AWS access key in our infrastructure. Upon detection, we immediately revoked all affected credentials and engaged our incident response processes, which included a comprehensive investigation.

Since April 13th, we have seen no further evidence of unauthorized activity within Porter networks and systems. Working closely with Cloudflare and Amazon, we have substantially completed the investigation of our environment and are continuing to prioritize supporting customers in their response efforts.

We have determined that the threat actor operated between 03:23 UTC April 11, 2026 and 15:24 UTC April 13, 2026. During this window, the threat actor leveraged IAM role chaining from Porter's infrastructure to access 21 customer cloud accounts. A few customers within the targeted group confirmed successful retrieval of on-cluster secrets. For these users, we currently have no evidence that secrets were abused or that other actions were taken beyond secret retrieval through this role chain. In particular, there was no evidence of any unauthorized modification of customer infrastructure for any of these users. Via the same initial access, the threat actor accessed credentials for the Porter GitHub App. Working with the GitHub team, we learned that requests were made to GitHub API endpoints for some users. We have since received confirmation that three customer repositories were cloned. User-configured Helm overrides and credentials for Porter integrations, including Slack and AI integrations for a limited number of users, were also exposed. All users with such credentials were directly informed this week.

[snip]

In the days since, we have:

Rotated all remaining Porter AWS access keys, including those not known to be affected Deployed additional logging and monitoring across all Porter AWS accounts Established endpoint detection and response, additional real-time alerting, an incident response retainer, and 24x7 monitoring with an outside security firm

Further restricted ingress network traffic

Engaged Cloudflare, Latacora, and AWS to audit our configurations

We will cover the full scope of our ongoing remediation, including elimination of long-lived access keys, least-privilege enforcement, role chaining restrictions, and expanded threat detection in a detailed write-up to follow.

What Porter customers should do

We have communicated tailored action items to all customers based on their levels of exposure. The following general steps apply to everyone:

Review GitHub activity logs

[snip]

Key events to look for:

Unexpected repository clones ("git.clone" events)

New deploy keys or SSH keys added to repositories

OAuth application authorizations you don't recognize

Changes to branch protection rules or webhook configurations

Rotate third-party credentials

Rotate credentials for any Porter integrations, including Slack, alerting services, and AI support, that have not been updated since April 14, 2026.

Engage a security firm if needed

[snip]

What comes next

The incident resulted from a stale, overprivileged access key. Our remediation is focused on eliminating the conditions that made this compromise possible, not just the specific vector that was exploited.

We will share a detailed write-up in the coming weeks covering our remediation and ongoing efforts to harden our infrastructure. We also intend to establish regular transparency updates on our security posture moving forward.

[snip]

Tell HN: Security Incident at Porter (YC S20)

The AI Rewrite Dilemma

Shakespeare owned a house in London. We know where it was

Ask HN: Founders, what are you building that survives a Mythos-class model?

Folding Ideas: Why was I invited to Beast Studios? [video]

ListifyText – Turn messy text into clean, structured lists instantly

Terminator: Code You See Onscreen [video]

Show HN: Pyra – a Python toolchain experiment inspired by uv and Bun

Stop Burning Money on UGC Creators: Generate Viral Ads with AI in Seconds

Only 13% of emails are written by people

Kevin Weil and Bill Peebles exit OpenAI as company continues to shed side quests

Cal.com OSS project goes closed source due to AI

Ryan Mather: My tips for getting the best results out of Claude Design

Show HN: Mind-OS – First free online AI dependency self‑assessment

The big business of survival bunkers

High Amplitude Disagreeableness

A simplified model of Fil-C

Show HN: recover-pdfs is a tool for revovering all the deleted PDFs from a disk

Official MCP Package for Dokploy

DARPA Launches HARQ to Build Multi-Qubit Quantum Systems

Australia's startup scene is thriving at last

Opus 4.7: better or worse so far compared to 4.6? (don't forget to upvote)

What Psychedelics Do to the Brain

Age verification app ready as EU moves to curb children's social media access

Chinese groups call for global AI governance framework – Chinadaily.com.cn

A Buick GNX Merged with an El Camino to Create This 470-HP Masterpiece

Logfare.ai – Free LLM Inference. No Auth. No Limits

Beyond the Hype: Practical and Responsible Use Cases for Agentic AI Webinar

Hacking the old HackerNews codebase

Using a USB switch as a full KVM

Show HN: Realtime Voice AI on ESP32 with Cloudflare Durable Objects

Tell HN: Security Incident at Porter (YC S20)

The AI Rewrite Dilemma

Shakespeare owned a house in London. We know where it was

Ask HN: Founders, what are you building that survives a Mythos-class model?

Folding Ideas: Why was I invited to Beast Studios? [video]

ListifyText – Turn messy text into clean, structured lists instantly

Terminator: Code You See Onscreen [video]

Show HN: Pyra – a Python toolchain experiment inspired by uv and Bun

Stop Burning Money on UGC Creators: Generate Viral Ads with AI in Seconds

Only 13% of emails are written by people

Kevin Weil and Bill Peebles exit OpenAI as company continues to shed side quests

Cal.com OSS project goes closed source due to AI

Ryan Mather: My tips for getting the best results out of Claude Design

Show HN: Mind-OS – First free online AI dependency self‑assessment

The big business of survival bunkers

High Amplitude Disagreeableness

A simplified model of Fil-C

Show HN: recover-pdfs is a tool for revovering all the deleted PDFs from a disk

Official MCP Package for Dokploy

DARPA Launches HARQ to Build Multi-Qubit Quantum Systems

Australia's startup scene is thriving at last

Opus 4.7: better or worse so far compared to 4.6? (don't forget to upvote)

What Psychedelics Do to the Brain

Age verification app ready as EU moves to curb children's social media access

Chinese groups call for global AI governance framework – Chinadaily.com.cn

A Buick GNX Merged with an El Camino to Create This 470-HP Masterpiece

Logfare.ai – Free LLM Inference. No Auth. No Limits

Beyond the Hype: Practical and Responsible Use Cases for Agentic AI Webinar

Hacking the old HackerNews codebase

Using a USB switch as a full KVM