Signs something is wrong
- Accounts you don’t recognise, or a sudden burst of sign-ups.
- Data changed or deleted that nobody on your team touched.
- A user says their details turned up somewhere, or they got strange emails that mention your app.
- A bill or usage jump you can’t explain.
- Your site shows something you didn’t put there.
First hour: close the door
Replace your keys
Create new secret keys for your database, payments, email and AI services, then revoke the old ones. Start with any key that could have been in your website or code.
Change passwords and turn on two-step sign-in
For your AI builder, database, host, GitHub, domain and email. Email matters most, because it can reset everything else.
Remove access you don’t need
Take out old collaborators, unused keys and test accounts with admin rights.
Go offline if data is still leaking
If private data is still being read, pausing the app for a few hours is better than leaving it open.
Keep the evidence
- Before you delete anything, save it: screenshots, the strange accounts, messages from users and your providers’ logs. Free plans often keep logs for only a short time.
- Write a timeline: when you noticed, what you saw, and what you changed, when.
- Don’t wipe and rebuild yet. Deleting the database or project can destroy the record of what happened.
Tell people
If your users’ personal data may have been exposed, tell them plainly: what happened, which data, what you’ve done, and what they should do, like changing a password they reuse elsewhere.
Who you must tell, and how fast, depends on where your users live. Under the GDPR in Europe, for example, you may have to tell the data protection authority within 72 hours of finding out. If you take payments or hold sensitive data, talk to a lawyer early.
Then: find the gap and close it
New keys stop anyone using what was stolen. They don’t close the gap that let someone in, like a table without access rules or a function anyone can call. Finding that means reading the code and the database rules.