KeyRotate now publishes Leak news: the breach advisories it sends to the app, on the web

Published 2026-10-26

KeyRotate's website has a new page: Leak news. When a service people keep keys or logins with is breached, Enfour publishes an advisory to KeyRotate within hours, and the app asks whether you used that service. Until now those advisories lived only inside the app. Now anyone can read them.

What is on it

Each entry is the advisory as the app receives it: what happened, the period that was affected, when the company says it was contained, the keys most likely to be affected, and the steps to take, with a link to the company's own notice. Incidents that compromise a certificate authority have their own section.

October 2026 alone filled it. There are 13 incidents and one certificate authority, covering:

• keys stolen from services people paste them into: STUDIO, Railway and the OpenCode Console
• a LiteLLM release that carried credential-stealing malware
• critical fixes for self-managed GitLab and Node.js
• the Onamae.com Desktop Cloud breach and the FX brokers whose customers lost trading logins through it
• warnings from SBI SECURITIES, State Bank of India and DigiD
• the eMudhra certificate authority compromise

We wrote about two of them in more detail: the STUDIO breach and the Onamae.com Desktop Cloud breach.

Straight from the alert system, signature and all

The page is not a copy that someone keeps up to date by hand. It reads the same feed the apps read. Every advisory list is signed offline with Enfour's key, which never touches a server, and KeyRotate rejects any list that isn't signed with the key built into it.

The Leak news page does the same check in your browser. It fetches the live list, verifies the Ed25519 signature against KeyRotate's pinned key, and shows a newer list only if the signature holds. So a new advisory appears on the web as soon as it reaches the apps, and someone who broke into a web server still could not put words on the page in Enfour's name. Without JavaScript, the page shows the list as of its last update.

The status line at the top says which advisory you are reading and when it was issued.

What the app does with the same advisory

Reading the news is the start. In KeyRotate, an advisory becomes a card on the Overview and a notification asking whether you used the service. If you did, the steps become a checklist that remembers your progress. Where an incident exposed API keys, KeyRotate marks the keys you saved with that service as exposed and can replace them all in one pass, updating every file that used them. It tells you only about services you said you use, and fetching advisories is a download: nothing about your keys leaves your Mac.

And in FrontierStack

FrontierStack receives the same signed advisories. When one names a service your websites are built with, the site shows a banner in Sites, an alert is raised in Security, and the service's own pane shows the advisory card. The AI Administrator can list them through its vendor_breaches tool. Paired with KeyRotate, a key FrontierStack holds can be replaced from the same checklist.

See the current list on the Leak news page.