According to CoinMeta, GitBook released an incident review report on November 4th. The report indicates that on November 2nd, attackers exploited a vulnerability in the SSO login process to forge employee sessions. They obtained access to the internal code repository and Cloudflare API keys by misconfiguring the GitHub application, which allowed them to access the production environment keys. The timeline shows that on November 3rd at 00:32, they acquired employee sessions and source code; at 01:48, they entered the production environment; at 03:58, the vulnerability was fixed; at 04:32, the affected accounts were isolated and the application was taken offline; and at 11:56, key rotation was completed, with services resuming after a downtime of about 16 hours. During this period, the attackers had access to GitBook API tokens, integration tokens, and session signing keys, but billing information, passwords, and the IP address were not leaked, and no evidence of customer data being modified was found. The investigation pointed to a targeted attack against a single customer. GitBook has since rotated all infrastructure and customer keys and invalidated the API tokens, stating that the attack was driven by AI proxies. The report was signed by CEO Sara Tandowsky and CTO Samy Pess.