Rocket.new Data Breach: Encrypted API Keys Exposed

Rocket.new, the Surat-based AI app-building platform, has told users that an attacker broke into part of its production systems on 27 October 2026 and obtained the encrypted API keys of about 0.2% of its users.

In an email notification sent on 28 October and seen by Cyber Kendra, the company asked every user, including those whose keys were not taken, to revoke and replace the third-party keys they had connected to Rocket.

According to the notice, signed by Rocket co-founder and CTO Rahul Shingala, the unauthorised access ran from 6:32 PM to 11:58 PM UTC on 27 October. That is a window of nearly five and a half hours, falling between 12:02 AM and 5:28 AM India time on 28 October.

Rocket says it has identified and fixed the root cause and has “confirmed the attacker no longer has access to any of our systems.” Users outside the affected group were told their keys were not in the compromised set but should rotate them anyway as a precaution.

Rocket did not say how many accounts the 0.2% represents. In its Rocket 1.0 launch announcement in April 2026, the company said more than 1.5 million people across 180 countries use the platform. If that figure still holds, the affected group would be roughly 3,000 users. That is only an estimate, because Rocket has not published a current count or said whether the percentage applies to all registered users or only to those who have stored keys.

Rocket, which grew out of developer tools company DhiWise, opened its “vibe coding” platform in beta in June 2025. Vibe coding means building software by describing it to an AI in plain language. Three months after the beta launch, Rocket raised a $15 million seed round led by Salesforce Ventures and Accel. It was founded by CEO Vishal Virani, Deepak Dhanak and Shingala.

The keys involved are credentials that users hand to Rocket so the apps it generates can talk to outside services. Rocket’s documentation lists connectors for providers such as Anthropic, ElevenLabs and HubSpot. Its security checklist also covers keys for backend and payment services such as Supabase and Stripe. Several connectors work at the task level, so each Rocket task holds its own copy of a key. A single user may therefore have the same credentials stored in many places. A leaked AI-provider key can run up usage charges on its owner’s account, while a database or payment key can expose an app’s data and customers.

The notice describes the stolen keys as encrypted. It does not say whether the attacker also reached the decryption keys or the systems that decrypt credentials when apps run. It also does not explain how the intruder got in or when Rocket first detected the activity. Nor does it say whether any other data, such as account details, project files or generated source code, was accessed.

What Rocket users should do

Rocket’s notice sets out four steps. First, revoke each third-party key used with Rocket in the service where it was created. Second, delete the old keys from your Rocket account, projects and tasks. Third, create new keys and add them back only where they are still needed. Finally, check each provider’s usage and billing for activity you don’t recognise. The company points users to its connectors documentation, where each provider’s page explains how to revoke or rotate a key.

The order matters. Deleting a key inside Rocket does not stop it from working. Only revoking it at the provider cuts off anyone who holds a copy, whether or not that copy can be decrypted. Developers who reused the same key in other apps or servers will need to update those as well. Usage logs should be reviewed from 27 October onward.

The disclosure comes days after Zeabur, a cloud platform used by Vibe coders, said it would shut down by 31 December. Zeabur suffered two breaches, the second of which affected 321,810 accounts and more than 3.2 million environment-variable records. Zeabur said credentials stolen in its first breach in August may have enabled the October attack. Blanket key rotation is meant to prevent exactly that kind of follow-on intrusion.

Cyber Kendra has asked Rocket how the attacker gained access, whether encryption keys were exposed, how many users fall within the 0.2%, and whether the incident has been reported to CERT-In, India’s national cyber incident response agency. This article will be updated with any response.