Composio

Hi, at my company we're currently discussing how to deal with this security incident and our response towards our clients.

For those using OAuth2 credentials, we'll be writing to them, explaining why their toolkits stopped working for them, and have to reauth. Two questions in this regard. Is it safe to do so? I understand the vector of attack has been dealt with and new connections are not in danger. Is this correct? Also, do we know if their credentials were exposed, and for how long, before being revoked?

For the API keys, should we wait until you have further details on the affected toolkits, or directly contact our clients? Do you have an ETA for this information?

Thanks

Most questions now answered: https://composio.dev/blog/composio-may-2026-security-incident#frequently-asked-questions

Does it fix the For You issue <@1020406737259462697> ?

<@1020406737259462697> , really sorry for the delay in response, thanks for linking the blog here!

<@1320466468021731449>, on the "For You" issue specifically, we've intentionally taken the dashboard down for now while we finish restoring it.