← Resend

2024 Resend — database API key exposed, all users

2024 Unknown records affected Share on X

Data compromised

Recipient/sender addresses; subjects; domains; API key names; logs; contacts

Technical writeup

Database API key exposed as client-side env var in Dashboard. Discovered Dec 30; access from Jan 7. All users: emails, domains, API keys (encrypted), logs, contacts. Email content not accessed. Remediated Jan 10; FBI, GDPR notified.

Root cause

Client-side credential exposure; misconfiguration

References