Hi, What is the status of the investigation? I don't see any updates on the blog post since 2 days ago. I want to understand the following: Regarding Oauth with white labeling: Should we rotate the client id & client secret? what about the conneted accounts? should we notify something to the users? Regarding Oauth through Composio (without white labeling): what about the conneted accounts? should we notify something to the users? Thanks!

Hi @Or, 1. Connected accounts (both white-labeled and managed): OAuth2 tokens across the affected toolkits were revoked as a precautionary measure, full list is in the [bulletin](https://composio.dev/blog/composio-may-2026-security-incident). End-users on those toolkits need to reconnect. 2. Notifying your users: We've already emailed customers whose accounts were flagged as potentially impacted. If your users didn't get one from us, they weren't flagged. 3. Rotating client_id/secret on your white-labeled OAuth: No additional guidance to share beyond the bulletin while the investigation is ongoing. We'll follow up here once we're in a position to. Lmk if anything specific you'd like to dig into.

Thanks @User ! Few questions: 1. I see for my users there are the following connected apps with status "active": amazon. linkedin, monday, slack, agentql, pandadoc. Are they fine to leave as is, or should I do something about it? 2. How can you notify my users if you don't have their emails? 3. Should I do anything on my end?

what is happening with TrustClaw? is this offering no more, have I lost my data and credits? so much for "Trust"

Hi there, Totally understand the frustration, and I'm sorry the uncertainty here has been stressful. On the investigation: no new public update beyond the bulletin yet. Material developments get posted there and on status.composio.dev, so that is the place to watch. The guidance we shared earlier still stands. Splitting it the way you asked: White-label OAuth (you own the client credentials): • Rotating your client ID and client secret is a sensible precaution. • For your connected accounts, OAuth tokens on affected toolkits were revoked as a precaution, so those end users will need to reconnect. Composio-managed OAuth (we hold the credentials): • There is nothing for you to rotate on your side. • Same as above, tokens on affected toolkits were revoked, so those end users will need to reconnect. You can check which of your toolkits are on the affected list in the bulletin. On notifying users: this part sits on your side. We notify our direct customers when an account is flagged as potentially impacted, but we do not hold your end users' email addresses, so we cannot reach them for you. For any affected toolkit, please ask those end users to re-authenticate.