blacksmith - Security incident affecting CI job logs – Notice details

On November 5, 2026, our security team detected and contained unauthorized access to the system that stores the console output (job logs) of CI jobs run on Blacksmith runners. The access was revoked the same day, a later attempt by the same party to regain access was blocked, and at this time there is no evidence that customer exposure goes beyond the job-log store. CI execution was not affected. The incident impacted job-log data belonging to approximately 2.6% of customer accounts, and we have contacted each of those customers directly with the specifics for their organization, so we do not believe any other customer needs to take action. Our investigation is ongoing, we will publish a full report once that work is complete, and any questions can go to security@blacksmith.sh.