Security
Breaches, attacks and emergency patches, quoted from each provider's status page.
Days without a breach
Days since the last breach anywhere was resolved.Breaches, 12 mo
Someone got in or secrets got out: unauthorized access, leaked credentials, keys to rotate. Adds 600 points.Attacks, 12 mo
DDoS, abuse or malicious traffic that hurt the service. Graded by impact like any outage.Patches, 12 mo
Downtime from fixing a vulnerability: emergency reboots, CVE mitigations. Graded by impact.Oct 20263 incidents
Oct 24PATCHNOT COUNTEDCloudinary · Notice regarding recently-reported Ruby regular expression vulnerabilities (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)Cloudinary notice on Ruby regular expression vulnerabilities (four CVEs) fixed upstream October 23, 2026. Cloudinary upgraded its own platform the same day, found no exploitation or customer impact, and says no action is needed for Cloudinary. Customers using Ruby in their own apps should update to a patched release.Dev APIs · source0m
Oct 21PATCHNOT COUNTEDCloudinary · Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619Dev APIs · source0m
Oct 1ATTACKSEV 2Ably · Elevated API ErrorsA DDoS attack caused elevated token-request errors with 503 responses in all Ably Realtime regions for about six minutes on October 1, 2026. Ably restored service by adding capacity and deployed traffic-blocking and rate-limiting rules. ably.com was also intermittently unavailable.Dev APIs · postmortem · source27m
Aug 20262 incidents
Aug 17ATTACKSEV 1Stytch · Emails not being deliveredAbuse of free-tier email sending exhausted quota with the primary email provider. Failover to the secondary provider reported success but did not deliver mail. All outbound email, including magic links, OTPs and password resets, failed from 09:15 to 12:15 UTC on 17 August. Malicious accounts were banned and new safeguards added. Sender reputation may cause some legitimate mail to land in spam for a while.Dev APIs · postmortem · source3h 33m
Aug 11ATTACKSEV 2Mailgun · Click and Open Tracking Degraded (US Regions)A denial-of-service attack hit Mailgun's click and open tracking servers in US regions from about 05:32 to 07:07 UTC on 11 August 2026. Some tracking requests timed out or failed. A fix was implemented and the incident was resolved.Dev APIs · source1h 35m
Jun 20261 incident
Jun 22OTHERSEV 2WorkOS · Degraded performance for Directory Provisioning for AuthkitA data migration unintentionally disabled AuthKit directory provisioning for existing customer directories from June 22 to June 25. User creations, attribute and role updates, and deactivations were delayed or missed. Affected directories were restored and missed changes backfilled. Some removed users may have kept organization access; no misuse was found. No directory events were lost.Dev APIs · postmortem · source2d 7h