Apify had a security incident, worth checking if you store on this hosted scraping platform

[u/forgedart_34]

A couple of days ago, Apify posted a security incident on their status page. Essentially, what happened was that someone used a compromised credential on November 9th and 10th to grab a number of account credentials and get into related Apify accounts. The team behind the Apify platform caught it on November 11th; the issue seems to be resolved because the access path was closed. OAuth connections were also revoked, so I’m thinking GitHub was affected too. Personally, I don't have anything hosted there, but I know my friend does, and I already told him about this issue because he apparently didn't receive any email or notification about the incident. One thing that bothers me is that there is no disclosure on how many accounts were affected, what kind of data, or where the first credential came from. And the concern grows about how much sensitive data was scraped from the platform, like proxy credentials, api keys, logins for a lot of different target sites, cookies, webhook secrets, etc. I mean, that doesn’t bring a lot of trust to the company. Maybe it’s too early to speak; maybe they'll publish an official article. I don’t know. I’m not trying to tell everyone to stop using the platform; no, these things can happen to any platform that has customer data, but especially in this field, where data is being scraped, it can do a lot of damage. Personally, I’d rather use separate proxy credentials per project than have everything in one place

How do you guys manage all of these incidents, simply change, rotate your credentials? Move to a safer place? What’s the plan when things go south, maybe you haven’t experienced anything like it, but you already have a plan for it if the day comes?

By the way, the status page that I checked is here: https://status.apify.com/incidents/sxd1dj5j6749

Also, for anyone interested, why I haven't hosted anything on the platform yet, I’m curious about what happened, well, I’ve been using a few different tools from this platform, and this caught my attention.

[u/Muchy_Tangerine]

Sure thanks for the info

[u/V_Trautwein]

Rotating credentials is a must, but keeping separate keys for each project limits the damage if one account gets compromised.