As a precaution, we immediately rotated our most sensitive production credentials."

PostHog Status

Current status of PostHog services

(www.posthogstatus.com)

Was still really hoping you were right.

Update: the 01:18 entry got edited. "Security exercise" is gone, now it says they're rotating keys after a research team confirmed an exploit in one of their AWS environments. So you called it. Incident-driven, not hygiene. Good catch.

Also #hugops since security incidents are never fun.

Also note the quiet update of the existing status (same timestamp as earlier update; no email sent out to incident subscribers).

"We are rotating keys after a security research team was able to confirm an exploit in one of our AWS environments. We're working with the security research team on the issue. No keys were publicly available, and no data has been compromised. You may see impacts on exports, reverse proxies, and other services. We'll have more updates as we continue to work on this incident."

PostHog Status

Current status of PostHog services

(www.posthogstatus.com)

There's been many unplanned issues that impacted web app availability, but none cited anything similar to this (like key rotation or security exercise).

I hope you're right and they forgot to announce it, but also seems unusual given they haven't done this before in a way that impacted web app availability, either as planned maintenance or unplanned maintenance. All the unplanned maintenance affecting web app uptime I've seen has never cited security exercise or key rotation.

"Unplanned" just means it wasn't on the maintenance calendar, not that it's an accident. A planned key rotation they didn't pre-announce lands there by default.

And it went from "doing maintenance" to "it's a security exercise" — that's the opposite of how a breach reads. Those escalate into an advisory and a "rotate your keys" email. None of that here. Fair to side-eye given the month we're having, but this looks like hygiene.