Security Bulletin: Supply-Chain Response and Precautionary Credential Rotation | System Status

Summary

Following the April 2026 security incident disclosed by Vercel, and additional third-party supply-chain communications received by Cloud Posse, we reviewed our exposure and elected — out of an abundance of caution — to rotate credentials for integrated services supporting Atmos Pro. The rotation required a redeployment; Atmos Pro was unavailable for approximately 30 minutes during this window. We have no evidence of unauthorized access to Cloud Posse systems, Atmos Pro infrastructure, or customer data. No customer action is required.

Updates

April 28, 2026 — Expanded with blast-radius framing, an explicit evidence-and-limitations statement, and a telemetry-improvement item in Follow-Up. Tightened the impact summary to evidence-limited language and removed an unbounded compliance-evidence offer. No factual claims were retracted; prior claims remain accurate and are now qualified with the evidentiary basis on which they rest.
April 21, 2026 — Initial publication.

Who Is Impacted

Atmos Pro customers experienced an approximately 30-minute service interruption during the redeployment window required to pick up rotated credentials. This duration was longer than intended due to procedural friction encountered during the rotation; the remediation is described in the Follow-Up section below.
Based on log review across the integration surfaces described in "What We Know" below, covering the window from the earliest possible exposure through the completion of rotation, we have no evidence that customer data, customer accounts, or running workflows were accessed, modified, or exfiltrated.

What We Know

On April 19–20, 2026, Vercel publicly disclosed a security incident involving compromise of a third-party AI tool used by a Vercel employee, which led to unauthorized access to some environments and non-sensitive environment variables within Vercel's infrastructure. Vercel's bulletin is available at https://vercel.com/kb/bulletin/vercel-april-2026-security-incident. Atmos Pro is hosted on Vercel.
We separately received additional third-party supply-chain communications that remained under embargo at the time of initial publication. We honored those embargoes for the duration; the related third-party disclosure is now public and is covered in our Inngest TypeScript SDK Disclosure bulletin.
We reviewed our exposure to these communications and elected to rotate credentials for integrated services as a precautionary measure.

Scope of the affected component and blast radius

The credentials we rotated are the service credentials Atmos Pro uses to call integrated third-party services. The affected categories and what each category can reach in our architecture:

Source control integration credentials — read/write access to repository metadata, pull requests, webhooks, and commit statuses within repositories explicitly installed on the Cloud Posse GitHub App. They do not grant access to customer filesystems, customer cloud accounts, or Cloud Posse production infrastructure.
Transactional email credentials — permission to send email from Cloud Posse–controlled sending domains. They do not grant access to received email or to customer mailboxes.
Managed database credentials — connection credentials to the Atmos Pro managed Postgres instance, which holds customer workspace state and configuration. These credentials authenticate to the database over TLS; we do not rely on network-level (IP allow-list) controls as a compensating boundary on our side, so the credential itself is the access-governing secret.
Background job credentials — permission to send and consume events on the Atmos Pro background-job namespace. They do not grant access to other tenants on the shared platform.
Observability credentials — write-only ingest tokens for metrics, traces, and logs. They do not grant read access to existing telemetry.

Controls that bound the worst-case blast radius, even assuming full credential compromise: credentials are environment-scoped per deployment; source-control permissions are scoped to installed repositories only, and under the GitHub App model org admins can revoke our access unilaterally without our cooperation; every credential in scope has now been rotated, invalidating any previously-captured value. We do not claim IP-based network isolation as a compensating control for the rotated credentials. We have no evidence that any of the remaining controls were tested by an attacker.

Evidence and limitations

Evidence reviewed: provider-side access and audit logs for the rotated integration categories, covering the window from the earliest plausible exposure implied by the upstream disclosures through the completion of rotation; our application's authentication, session, and background-job logs over the same window; and deployment history for all Atmos Pro environments.
What we can defensibly conclude: we have no evidence of anomalous authentications, anomalous API calls, anomalous data egress, or unexpected deployments attributable to the rotated credentials during the reviewed window.
What we cannot conclude from this evidence alone: not every integration surface provides equally granular logs, and some provider-side logs have retention windows shorter than the full historical lifetime of the rotated credentials. Our evidence therefore supports "no observed compromise within the reviewed window on the surfaces where granular logs exist" — not "no compromise possible." Our rotation and review are precautionary, consistent with that framing.

What We Did

Rotated credentials for integrated services supporting Atmos Pro, including source control, email delivery, database, background job, and observability providers.
Redeployed Atmos Pro so that the rotated credentials took effect across all environments.
Reviewed provider-side audit and access logs for the rotated integration categories, and our own authentication, session, and background-job logs, for indicators of compromise across the window described above.
Confirmed normal operation following the redeployment.

Recommendations for Customers

No customer action is required at this time.

Indicators of Compromise

None observed in our systems at the time of this publication.

Follow-Up

Rotation runbook. The procedural friction that extended this rotation window has been addressed by documenting every step of the credential rotation process. Based on this documentation, future rotations are expected to complete in under 5 minutes of downtime.
Telemetry and logging improvements. As part of this response we identified integration surfaces where our own retained audit detail is coarser than we would like for post-incident review. We are narrowing those gaps by centralizing integration-side audit log ingestion into our observability pipeline, increasing retention for security-relevant events, and adding detection rules for anomalous credential use. This work reduces — but does not eliminate — the evidence limitations acknowledged above, and we will describe material changes in future bulletins as they ship.
Embargoed communications. Those embargoes have since expired. The related third-party disclosure is published in our Inngest TypeScript SDK Disclosure bulletin.
Ongoing review. We continue to monitor for additional information from affected upstream vendors and will disclose any material new findings as dated entries in the Updates section above.

Summary

Updates

April 28, 2026 — Expanded with blast-radius framing, an explicit evidence-and-limitations statement, and a telemetry-improvement item in Follow-Up. Tightened the impact summary to evidence-limited language and removed an unbounded compliance-evidence offer. No factual claims were retracted; prior claims remain accurate and are now qualified with the evidentiary basis on which they rest.

April 21, 2026 — Initial publication.

Who Is Impacted

Atmos Pro customers experienced an approximately 30-minute service interruption during the redeployment window required to pick up rotated credentials. This duration was longer than intended due to procedural friction encountered during the rotation; the remediation is described in the Follow-Up section below.

Based on log review across the integration surfaces described in "What We Know" below, covering the window from the earliest possible exposure through the completion of rotation, we have no evidence that customer data, customer accounts, or running workflows were accessed, modified, or exfiltrated.

What We Know

On April 19–20, 2026, Vercel publicly disclosed a security incident involving compromise of a third-party AI tool used by a Vercel employee, which led to unauthorized access to some environments and non-sensitive environment variables within Vercel's infrastructure. Vercel's bulletin is available at https://vercel.com/kb/bulletin/vercel-april-2026-security-incident. Atmos Pro is hosted on Vercel.

We separately received additional third-party supply-chain communications that remained under embargo at the time of initial publication. We honored those embargoes for the duration; the related third-party disclosure is now public and is covered in our Inngest TypeScript SDK Disclosure bulletin.

We reviewed our exposure to these communications and elected to rotate credentials for integrated services as a precautionary measure.

The credentials we rotated are the service credentials Atmos Pro uses to call integrated third-party services. The affected categories and what each category can reach in our architecture:

Source control integration credentials — read/write access to repository metadata, pull requests, webhooks, and commit statuses within repositories explicitly installed on the Cloud Posse GitHub App. They do not grant access to customer filesystems, customer cloud accounts, or Cloud Posse production infrastructure.

Transactional email credentials — permission to send email from Cloud Posse–controlled sending domains. They do not grant access to received email or to customer mailboxes.

Managed database credentials — connection credentials to the Atmos Pro managed Postgres instance, which holds customer workspace state and configuration. These credentials authenticate to the database over TLS; we do not rely on network-level (IP allow-list) controls as a compensating boundary on our side, so the credential itself is the access-governing secret.

Background job credentials — permission to send and consume events on the Atmos Pro background-job namespace. They do not grant access to other tenants on the shared platform.

Observability credentials — write-only ingest tokens for metrics, traces, and logs. They do not grant read access to existing telemetry.

Evidence reviewed: provider-side access and audit logs for the rotated integration categories, covering the window from the earliest plausible exposure implied by the upstream disclosures through the completion of rotation; our application's authentication, session, and background-job logs over the same window; and deployment history for all Atmos Pro environments.

What we can defensibly conclude: we have no evidence of anomalous authentications, anomalous API calls, anomalous data egress, or unexpected deployments attributable to the rotated credentials during the reviewed window.

What we cannot conclude from this evidence alone: not every integration surface provides equally granular logs, and some provider-side logs have retention windows shorter than the full historical lifetime of the rotated credentials. Our evidence therefore supports "no observed compromise within the reviewed window on the surfaces where granular logs exist" — not "no compromise possible." Our rotation and review are precautionary, consistent with that framing.

What We Did

Rotated credentials for integrated services supporting Atmos Pro, including source control, email delivery, database, background job, and observability providers.

Redeployed Atmos Pro so that the rotated credentials took effect across all environments.

Reviewed provider-side audit and access logs for the rotated integration categories, and our own authentication, session, and background-job logs, for indicators of compromise across the window described above.

Confirmed normal operation following the redeployment.

Follow-Up

Rotation runbook. The procedural friction that extended this rotation window has been addressed by documenting every step of the credential rotation process. Based on this documentation, future rotations are expected to complete in under 5 minutes of downtime.

Telemetry and logging improvements. As part of this response we identified integration surfaces where our own retained audit detail is coarser than we would like for post-incident review. We are narrowing those gaps by centralizing integration-side audit log ingestion into our observability pipeline, increasing retention for security-relevant events, and adding detection rules for anomalous credential use. This work reduces — but does not eliminate — the evidence limitations acknowledged above, and we will describe material changes in future bulletins as they ship.

Embargoed communications. Those embargoes have since expired. The related third-party disclosure is published in our Inngest TypeScript SDK Disclosure bulletin.

Ongoing review. We continue to monitor for additional information from affected upstream vendors and will disclose any material new findings as dated entries in the Updates section above.