October 2026 security incident

19 October 2026, updated 23 October 2026

We are writing to tell you about a security incident affecting APITemplate.io, what we have done about it, and the steps we recommend you take.

What happened

Between 12 and 16 October 2026, an unauthorised party exploited a vulnerability in the service that renders documents from templates. The vulnerability let specially crafted templates run code on our servers, which they used to access parts of our systems.

Once we identified the activity, we removed their access, fixed the vulnerability on 16 October and began an investigation. We have found no activity by the unauthorised party in our systems since 16 October.

What information was involved

Our investigation found that the unauthorised party accessed:

• Storage credentials saved in post actions. If your account had a post action that uploads to Amazon S3, Cloudflare R2, another S3-compatible service or Azure, including an inactive one, the access key or connection string saved in it was accessed.
• Account information, including the email addresses of users who sign in with Google.
• The passwords of a small number of accounts, captured while those users signed in during the incident. We have reset these passwords.
• API logs from a limited period for some customers, which contain API keys, the data sent to generate documents, and links to generated documents.
• Content submitted to our free PDF tools between 7 and 14 October 2026 (UTC).

We do not store payment card numbers; payments are processed by Stripe.

Apart from one customer’s template, which was changed and restored within about a minute, we have found no evidence that the unauthorised party changed or deleted customer data, templates or account settings. The service remained available throughout.

What we have done

• 16 October: fixed the vulnerability in every region, and added safeguards to how templates are rendered.
• 16 October: removed the unauthorised party’s access and everything they created in our systems, deleted the files they generated through our service, and rebuilt our application servers. We kept a record of their activity for the investigation.
• 17 October: re-scanned our cloud account, logs and databases, and found no activity by the unauthorised party after 16 October.
• 17 October: identified the affected customers by reconstructing exactly which records and logs were accessed.
• 18 October: replaced our database password and the secret keys used for payment processing, Google sign-in and user sessions. As a result, you may have been signed out and need to sign in again.
• 18 October: stopped our API and document-generation services from recording credentials, API keys and request data in their logs.
• 18 October: turned on automated threat detection in every cloud region where our services run.
• 19 October: re-scanned our cloud account again and found no further activity.
• 19 October: reset the passwords of the accounts whose sign-in passwords were captured, and signed them out.
• 19 October: removed the generated documents and uploaded images whose links were in the accessed data, after keeping a private backup copy, and cleared them from our content delivery network. We have emailed the owners.
• 19 October: turned on access logging for our file storage and content delivery network, so every access to stored files is now recorded.
• 19 October: restricted the API that lists generated documents for the accounts whose API keys were exposed, until those keys are replaced.
• 19 October: reported the incident to Singapore’s Personal Data Protection Commission.
• 20 October: moved our services from long-lived access keys to short-lived credentials that are rotated automatically. Document links that stay valid for up to 7 days are now signed with separate keys that can only read generated documents.
• 20 October: reviewed the new file-storage access logs and found no activity by the unauthorised party.
• 20 October: checked how each exposed API key has been used since the incident, and found no sign that the unauthorised party used any of them after 16 October.
• 21 October: removed from public storage every PDF document generated before 17 October 2026, after keeping a private backup copy. Links to these documents no longer work.
• 21 October: extended our security monitoring and alerting. Our team is now alerted within minutes to threat-detection findings, to unusual activity in our cloud account, file storage and content delivery network, and to changes to our logging and detection settings. We also now keep network traffic logs for our servers.
• 21 October: further limited what our document renderer can access.
• 21 October: re-encrypted the storage credentials saved in post actions with a new key, and deleted the old copies.
• 22 October: removed the old encryption key everywhere it was used, so only the new key can read saved storage credentials. This doesn’t undo the earlier access, so please still revoke those credentials (see below).
• 22 October: gave each of our products its own database login, limited to what it needs.
• 22 October: started logging every database connection and every change to database structure or permissions.
• 23 October: tightened checks on files uploaded in the template editor.

What you should do

If you use post actions, please act today, even if the post action is inactive or you no longer use it:

1. Revoke the access key or connection string at your storage provider.
2. Check your provider’s logs from 12 October 2026 onwards for access you don’t recognise.
3. If you still need the post action, create a replacement credential that can only upload files, which is all APITemplate.io needs. Then save it in your post action.

If we contacted you about your API key, replace it: see “How do I rotate my API key?” below.

Everyone:

• If you sign in with a password, change it, and change it anywhere else you use the same password. We also recommend turning on two-factor authentication.
• Be alert to phishing. We will never ask for your password or API key by email.
• If you used our free PDF tools between 7 and 14 October 2026 (UTC), be aware that what you entered may have been accessed.
• We have removed PDF documents generated before 17 October 2026. If images you generated before then contain sensitive information and you no longer need them, delete them with the delete-object API, or ask us to.
• If a document link no longer works, it may be one we removed after the incident: generate the document again to get a new link, or contact us if you need the original file back.

Questions

How do I know whether I’m affected?

If your account needs specific action, we have emailed the account owner. Everyone should follow the steps under “Everyone” above.

Is it safe to keep using APITemplate.io?

Yes. The vulnerability is fixed and the unauthorised party’s access has been removed. We have replaced the passwords and keys that gave access to our cloud account, database and payment processing, and the key that protects saved storage credentials; we will replace the remaining internal keys.

Was my payment card exposed?

No. We do not store card numbers.

How do I rotate my API key?

Rotating moves your integrations to a new key, then retires the old one, without downtime:

1. Open the API Integration page of your workspace. For a team’s key, switch to the team workspace first; team keys are separate from personal keys.
2. Choose Create API Key. Each workspace can have up to two keys, so if the button is disabled, deactivate and delete a key you no longer use first.
3. Update your applications and integrations to use the new key. Both keys work during the switch-over. The Log Request setting isn’t copied to the new key, so check it.
4. Deactivate the old key, then delete it.

If you can update your integrations straight away, you can instead choose Reset API Key on the old key. This replaces it in place, and the old value stops working immediately. More detail: Managing & Rotating API Keys.

Who can I contact?

Email support@apitemplate.io. Please don’t include passwords, keys or other secrets in your message.