Security incident notice

19 October 2026

We are writing to tell you about a security incident affecting APITemplate.io, what we have done about it, and the steps we recommend you take.

What happened

Between 12 and 16 October 2026, an unauthorised party exploited a vulnerability in the service that renders documents from templates. The vulnerability let specially crafted templates run code on our servers, which they used to access parts of our systems.

Once we identified the activity, we removed their access, fixed the vulnerability on 16 October and began an investigation. We have found no activity by the unauthorised party in our systems since 16 October.

What information was involved

Our investigation found that the unauthorised party accessed:

• Storage credentials saved in post actions. If your account had a post action that uploads to Amazon S3, Cloudflare R2, another S3-compatible service or Azure, including an inactive one, the access key or connection string saved in it was accessed.
• Account information, including the email addresses of users who sign in with Google.
• The passwords of a small number of accounts, captured while those users signed in during the incident. We have reset these passwords.
• API logs from a limited period for some customers, which contain API keys, the data sent to generate documents, and links to generated documents.
• Content submitted to our free PDF tools between 7 and 14 October 2026.

We do not store payment card numbers; payments are processed by Stripe.

Apart from one customer’s template, which was changed and restored within about a minute, we have found no evidence that the unauthorised party changed or deleted customer data, templates or account settings. The service remained available throughout.

What we have done

• 16 October: fixed the vulnerability in every region, and added safeguards to how templates are rendered.
• 16 October: removed the unauthorised party’s access and everything they created in our systems, deleted the files they generated through our service, and rebuilt our application servers. We kept a record of their activity for the investigation.
• 17 October: re-scanned our cloud account, logs and databases, and found no activity by the unauthorised party after 16 October.
• 17 October: identified the affected customers by reconstructing exactly which records and logs were accessed.
• 18 October: replaced our database password and the secret keys used for payment processing, Google sign-in and user sessions. As a result, you may have been signed out and need to sign in again.
• 18 October: stopped our API and document-generation services from recording credentials, API keys and request data in their logs.
• 18 October: turned on automated threat detection in every cloud region where our services run.
• 18 October: added alerts for high-risk changes to our cloud account.
• 18 October: replaced the remaining internal credentials our services use.
• 19 October: re-scanned our cloud account again and found no further activity.
• 19 October: reset the passwords of the accounts whose sign-in passwords were captured, and signed them out.
• 19 October: removed the generated documents and uploaded images whose links were in the accessed data, after keeping a private backup copy, and cleared them from our content delivery network. We have emailed the owners.
• 19 October: turned on access logging for our file storage and content delivery network, so every access to stored files is now recorded.
• 19 October: restricted the API that lists generated documents for the accounts whose API keys were exposed, until those keys are replaced.

What you should do

If you use post actions, please act today, even if the post action is inactive or you no longer use it:

1. Revoke the access key or connection string at your storage provider.
2. Check your provider’s logs from 12 October 2026 onwards for access you don’t recognise.
3. If you still need the post action, create a replacement credential that can only upload files, which is all APITemplate.io needs. Then save it in your post action.

If we contacted you about your API key, replace it: see “How do I rotate my API key?” below.

Everyone:

• If you sign in with a password, change it, and change it anywhere else you use the same password. We also recommend turning on two-factor authentication.
• Be alert to phishing. We will never ask for your password or API key by email.
• If you used our free PDF tools between 7 and 14 October 2026, be aware that what you entered may have been accessed.
• If documents you generated before 16 October 2026 contain sensitive information and you no longer need them, delete them with the delete-object API, or ask us to.
• If a document link you shared no longer works, it may be one we removed after the incident: generate the document again to get a new link.

Questions

How do I know whether I’m affected?

If your account needs specific action, we have emailed the account owner. Everyone should follow the steps under “Everyone” above.

Is it safe to keep using APITemplate.io?

Yes. The vulnerability is fixed, the unauthorised party’s access has been removed, and the credentials they obtained have been replaced.

Was my payment card exposed?

No. We do not store card numbers.

How do I rotate my API key?

Rotating moves your integrations to a new key, then retires the old one, without downtime:

1. Open the API Integration page of your workspace. For a team’s key, switch to the team workspace first; team keys are separate from personal keys.
2. Choose Create API Key. Each workspace can have up to two keys, so if the button is disabled, deactivate and delete a key you no longer use first.
3. Update your applications and integrations to use the new key. Both keys work during the switch-over. The Log Request setting isn’t copied to the new key, so check it.
4. Deactivate the old key, then delete it.

If you can update your integrations straight away, you can instead choose Reset API Key on the old key. This replaces it in place, and the old value stops working immediately. More detail: Managing & Rotating API Keys.

Who can I contact?

Email support@apitemplate.io. Please don’t include passwords, keys or other secrets in your message.