Emerging Threat: CircleCI Security Incident

Expel is responding to CircleCI’s reported security incident that may have exposed credentials stored in CircleCI. They report no evidence of misuse of Expel credentials, describe existing mitigations (automated daily rotation for high-risk secrets and detection for exposed-credential use), and recommend immediate rotation of any credentials stored in CircleCI, auditing credential usage, and longer-term controls such as short-lived credentials and canary secrets.