Tell HN: Warp.dev Security Incident

Posted by himata4113 11 hours ago

Hello,

In our ongoing investigation into a recent security incident we detected that agent traces from your account may have had secret keys in them.

We have no knowledge of what these keys are or if they are truly sensitive. Regardless, out of an abundance of caution, we believe it’s worth considering rotating them. At this time, we have no evidence of misuse or abuse but we are sharing these initial findings as quickly as possible so you can consider the appropriate course of action.

We have provided the hashed and redacted tokens below.

...

Protecting our customers’ data is a top priority, and we will continue to keep you informed should our investigation uncover additional relevant information.

– The Warp Team

Does this mean that they've lied about ZDR? We haven't used warp in almost a year, yet they still have information about one of my collegues.

Comments

Comment by parable 10 hours ago

To the best of my understanding, ZDR is often a promise that your data is not used for model training. It doesn't mean "what it says on the tin", so to speak. There are cases where data needs to be retained regardless, for example, preventing abuse. This isn't for training, so a company can still claim ZDR.

Comment by himata4113 9 hours ago

I'm fairly sure the ZDR on their site impled that neither the prompts or the model output was collected before they've changed their site few dozen times.

They still mention: "meaning they do not store or train on your data", but only on the providers side which makes quite a lot of sense, there's very little reason for them to store anything except some analytics data in cases like these.