The notification lands late at night: Zeabur has been breached, and the attackers may have read your environment variables.
Your OpenAI key, your database password and the token your n8n workflows use to post to Slack could all be exposed. Then, a few days later, a second email says Zeabur is closing down for good.
This happened to Zeabur users in 2026. The Taiwan-based PaaS suffered two breaches in under seven weeks, in late August and again on 14–15 October. Users’ environment variables, account details, API tokens and email-service keys were reportedly exposed, and some users found their AI API keys stolen and misused.
On 17 October 2026, Zeabur announced it would shut down completely by 31 December 2026.
Malaysian businesses are not immune to this kind of incident. MyCERT received 195 data breach reports in the first quarter of 2025 alone, up nearly 29% on the previous quarter.
If your apps were hosted on Zeabur, moving them to a Zeabur alternative is not enough on its own.
This checklist covers what to lock down today, how to migrate without carrying the problem with you, and what to demand from your next host.
Do This Today: Your Zeabur Breach Security Checklist
Treat every secret stored on Zeabur as compromised, even if you haven’t seen any misuse yet. Work through this list in order:
- Rotate every AI API key: Revoke and reissue keys for OpenAI, Anthropic, Gemini, OpenRouter and any other AI provider your apps call. Stolen AI keys are attractive because attackers can turn them straight into paid usage on your bill.
- Change all database passwords: Reset passwords for PostgreSQL, MySQL, MongoDB and Redis, then update the connection strings in your apps. Do it for read-only users too.
- Regenerate platform and third-party tokens: This covers your Zeabur API token, GitHub deploy keys, Slack and Telegram bot tokens, payment gateway keys and webhook secrets.
- Replace email-service API keys: Zeabur has revoked old zSend and Zeabur Email keys, so create new ones if you still use them. Do the same for any other email service connected to your apps, so nobody can send phishing emails from your domain.
- Check your servers for intruders: If you had Zeabur dedicated servers, change the root password and remove any SSH keys you don’t recognise from ~/.ssh/authorized_keys, especially one reportedly named “zeabur-pentest”.
- Sign in again everywhere: Log out of all sessions and turn on two-factor authentication on every account that offers it.
The OWASP Secrets Management Cheat Sheet puts it simply: revoke an exposed secret immediately, issue a replacement and remove the old value from code, logs and systems.
Check for Damage Before It Shows Up on Your Bill
Rotating keys stops future misuse, but it doesn’t tell you what has already happened. Spend an hour on these checks:
- Review AI provider usage dashboards: Look for spikes in token usage, unfamiliar models or calls at odd hours since late August. Set spending limits and usage alerts while you’re there.
- Audit your cloud and payment accounts: Check invoices, new users, new API keys and changed permissions you didn’t create.
- Read your app and database logs: Look for unusual queries, bulk exports or logins from unfamiliar IP addresses.
- Check outgoing email reputation: A sudden spike in bounce rates or spam complaints can mean someone used your email keys.
- Keep records: Screenshot unusual charges and log entries with dates. You’ll need them for Zeabur’s compensation claims and for reporting.
If customer personal data may have been exposed, take this seriously.
Since 1 June 2025, Malaysia’s amended Personal Data Protection Act has required organisations to notify the Personal Data Protection Commissioner within 72 hours of becoming aware of a breach, and to inform affected individuals within seven days where there is a risk of significant harm.
If you’re unsure how serious it is, professional incident response services can help you contain the damage and work out what was accessed.
Migrate Without Carrying the Breach With You
A rushed move can copy compromised settings straight into your new environment. Follow these rules as you migrate:
- Back up first, from a clean session. Export your databases, files and app data before the shutdown dates, and store a copy off-server. Don’t wait for a data deletion deadline to be announced.
- Never copy old environment variables across. Use only the new secrets you created in the checklist above. If an old .env file travels with you, the leaked keys travel too.
- Rebuild, don’t clone, where you can. Deploy from your Git repository onto a fresh server rather than copying a full disk image that might include something an attacker left behind.
- Move your domains early. Transfer any domains registered through Zeabur to a registrar you trust. Exabytes’ domain transfer service keeps your domain and DNS under your control.
- Test before you switch DNS. Run your apps on the new server, check every integration with the new keys, then point your domain over.
- Revoke anything you missed. After cut-over, delete your old account data and confirm every old key has been revoked.
For a full walkthrough of the move itself, see our step-by-step Zeabur migration guide.
What to Demand From Your Zeabur Alternative
Both Zeabur breaches reportedly started in a shared cluster that was due to be retired but was still running, and a legacy API key with no scope or expiry made the damage worse. Use that as your checklist when you choose a Zeabur alternative:
| What to ask | Why it matters | What good looks like |
| Is my server isolated? | Shared clusters let one weak point affect many customers | Your own VPS with full root access, isolated from other users |
| Where is my data stored? | You need to know the jurisdiction for PDPA purposes | A named Malaysian data centre with Tier III design |
| Are backups off-server? | Same-server backups can be lost along with the server | Off-server VPS backup with clear retention |
| Can I enforce two-factor authentication? | Stolen passwords alone shouldn’t open your account | Two-factor authentication on the client portal |
| Is the platform tested by security professionals? | You want problems found by testers before attackers find them | Regular vulnerability assessment and penetration testing |
| Can I export everything in standard formats? | You must be able to leave quickly if you ever need to | Standard Linux, Docker and database dumps, with no proprietary build lock-in |
| Is support local? | Incidents don’t wait for another time zone’s office hours | 24/7 support based in Malaysia |
If you’re still weighing up whether to go with another PaaS, a VPS or managed cloud, our Zeabur alternative guide comparing PaaS, VPS and managed cloud explains the trade-offs.
Store Secrets Properly on Your New Server
Moving is the right time to fix how you handle secrets, so a future incident does less damage:
- Use scoped, expiring keys: Create a separate key for each app with only the permissions it needs, and set an expiry where the provider allows it.
- Keep secrets out of code and images: Never commit .env files to Git or bake keys into Docker images. Load them at runtime from protected files or a secrets manager.
- Set spending caps: Put hard monthly limits on every AI and cloud account, so a leaked key has a ceiling.
- Rotate on a schedule: Put key rotation in the calendar every 90 days, and immediately whenever a team member leaves.
- Keep AI workloads close to home: For GPU-heavy AI projects that handle sensitive data, sovereign AI compute hosted in Malaysia keeps both the processing and the data within the country.
Rebuild on a Zeabur Alternative You Can Trust
Zeabur’s breach and closure is a hard way to learn about hosting security, but it gives you a clean start. Rotate everything, check for damage, move to an isolated environment and set up secrets properly this time.
Exabytes NVMe VPS gives you your own isolated server in Exabytes’ Malaysian data centre, with full root access, NVMe SSD storage, snapshots and optional off-server backup, plus local support when you need it.
Pre-configured plans for n8n and OpenClaw mean you can redeploy your automations on a fresh, clean server with your newly rotated keys.
Frequently Asked Questions
Is it safe to keep my apps on Zeabur until 31 December?
Rotate every secret now, whatever your migration date. Zeabur stops dedicated server renewals on 1 December 2026 and each server shuts down on its expiry date, so plan to finish your move to a Zeabur alternative before your own server’s expiry, not on the final day.
What should I do first after my hosting provider is breached?
Revoke and replace every secret that was stored on the platform, starting with AI API keys, database passwords and payment keys. Then sign out of all sessions, turn on two-factor authentication and check your usage dashboards for unusual activity.
Do I need to rotate keys even if I see no misuse?
Yes. Attackers often sell or use stolen keys weeks later, and some misuse doesn’t show up until your next bill. If a secret was stored where the attacker had access, treat it as compromised and replace it.
Can I copy my old .env file to my new server?
No. Your old environment file contains the very secrets that may have leaked. Create fresh keys and passwords first, then build a new environment file with only the new values.
Do I have to report a hosting breach under Malaysia’s PDPA?
If personal data you control was affected, the amended PDPA requires you to notify the Personal Data Protection Commissioner within 72 hours of becoming aware of the breach. You may also need to inform affected individuals within seven days. Get professional advice to confirm your specific obligations.
Is a VPS more secure than a shared platform?
A VPS isolates your workloads in your own virtual server, so problems on a shared cluster can’t reach your data as easily. You still need to keep it updated and secure, or add a management plan so a technical team does it for you.
This article provides general information only and does not constitute legal or professional security advice. For your specific obligations under Malaysia’s Personal Data Protection Act, consult a qualified legal or data protection adviser. If you believe customer data has been exposed, seek professional incident response support immediately.
