Rotate third-party keys you stored on an AI platform
Fireworks AI: API keys captured from evaluation-job secrets · Security incident · Web · fireworks.ai · Oct 2026
Fireworks AI said an attacker used internal Fireworks credentials to read environment variables in some customers' evaluation jobs, capturing API keys and tokens stored as secrets. It revoked affected Fireworks keys, but third-party keys have to be rotated with the provider that issued them.
Lesson
Only give a platform the secrets a job truly needs, prefer narrow keys with spend limits, and keep a list of where each key lives. Fireworks notes that removing a stored secret does not invalidate the credential; rotate it with its issuer.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
My project stores API keys and tokens as secrets on outside platforms (AI inference or eval platforms, hosting, CI). Help me reduce what a breach at one of those platforms could expose. 1) Help me list every secret my project uses and which platforms hold a copy of it, without printing any values. 2) For each one, tell me whether that platform actually needs it, and whether a narrower key (read-only, single project, limited scopes, spend cap) would work instead. 3) Write me a rotation plan: where to create the new key at the issuer, where to update it, and how to revoke the old one, since deleting a stored secret doesn't revoke it. 4) Suggest how to keep this inventory up to date in a short SECRETS.md that lists names and locations only, never values. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Web ↗