ACTION REQUIRED Stacker security incident On Monday 2nd November at 1:58 PM UTC, we were notified of a serious security incident impacting Stacker Classic and Stacker Astra. We fixed the vulnerability by 5:30 PM UTC the same day. The vulnerability would have enabled an attacker to take over any Stacker account using only knowledge of their email address. This would give the attacker full access to a Stacker account. We have no evidence that this vulnerability was exploited. However out of an abundance of caution we have taken then decision to reset all Stacker API Tokens and Integration Keys. This will have caused aspects of your Stacker applications to break without prior warning. This is a decision we didn’t take lightly but considered necessary given the nature of this security vulnerability. API Tokens: all Stacker users logged out Rotating all API Tokens will have caused existing sessions to have been logged out. You’ll need to log in again to access Stacker. Depending on your Stacker setup this may also have caused your customers to be logged out too, they will also need to log in again. Integration Keys: all integrations will need to be reset Rotating all Integration Keys will have caused all integrations that use our Integration Keys to return errors. You’ll need to log in to Stacker, retrieve your updated Integration Key and then paste it in the system you have integrated. This applies to most integrations with Stacker, including our Zapier integration. Investing in Stacker security We are continuing to investigate this vulnerability and will update you in due course with any updates we find. As a result of this vulnerability being identified we’re taking additional steps to further invest in Stacker security. We’re engaging with external security experts to conduct further tests to ensure the security of your applications, and we’ll be making further enhancements to the security of the platform in the days and weeks ahead. We take the trust that you place in Stacker extremely seriously, and we deeply apologize for the impact this vulnerability will have had on you and your work. If you have further questions or you need help with the steps to get your applications working again, please don’t hesitate to reach out to support@stackerhq.com or to me directly at sam@stackerhq.com. Note: workspaces using Enterprise Single Sign On on Astra were not impacted by this issue.

Sam, thanks. "We have no evidence that this vulnerability was exploited." - Will this be forensically investigated and confirmed to each customer - Like many we have a lot of PII data across our apps which, in the UK, would trigger a ICO report.

We are investigating this further however we so far haven’t found the information that would allow us to conclusively determine whether the vulnerability had been exploited. We’re able to run specific reports for a given workspace and can share with you the results but these results will not be conclusive unfortunately. E.g. broadly speaking we are able to identify if a user account wasn’t exploited, but if a user account was used normally we aren’t (yet) able to determine if it was exploited.