{"id":"INC-gitbook-01M6FXDDGQRWHMYYWXY2REQ46X","kind":"incident","aliases":[],"related":[],"title":"GitBook: Security incident impacting published sites and GitBook app","description":"As promised, now that the incident is resolved, we’ve published our full post-mortem on the recent security incident.\n\n[**Read the full post-mortem**](https://www.gitbook.com/status/security-incident-2026-11-03)\n\nThe post explains what happened, a full timeline, exactly which customer data was accessible, how we responded to protect our customers, and what we’re doing next.\n\nWe apologize again for the disruption. We hold ourselves to the highest standards, and we know an incident like this affects the trust you place in GitBook. \n\nWe hope the transparency in this post-mortem, our previous communications, and the actions we’ve taken help rebuild it.\n\nIf you have questions, contact your account manager or reply to this email to speak to our support team. For live updates, visit [status.gitbook.com](http://status.gitbook.com).\n\n**Sara Tandowsky, GitBook CEO**\n**Samy Pessé, GitBook Co-founder & CTO**","summary":"GitBook, a hosted documentation platform, had a security incident affecting published sites and the GitBook app, now resolved. The sources say customer data was accessible to an attacker, but the text here does not list which data or how access was gained.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GitBook","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["gitbook","incident","security","self-hosted","vendor"],"not_affected_if":["no-gitbook-account"],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-11-03T05:16:51+00:00","first_seen_at":"2026-11-08T16:45:35+00:00","triaged_at":"2026-11-08T16:46:23+00:00","updated_at":"2026-11-08T16:46:23+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T16:46:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GitBook: security incident exposed customer data on published sites and app","impact":"high","summary":"GitBook, a hosted documentation platform, had a security incident affecting published sites and the GitBook app, now resolved. The sources say customer data was accessible to an attacker, but the text here does not list which data or how access was gained.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["gitbook","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"customer data readable by an attacker","analyst_note":"Read the post-mortem at https://www.gitbook.com/status/security-incident-2026-11-03 to confirm which customer data was exposed and whether customers must rotate credentials or tokens.","how_to_check":"- unknown","plain_action":"","product_name":"GitBook","needs_analyst":true,"not_affected_if":["no-gitbook-account"],"who_is_affected":"GitBook customers whose published sites or GitBook app accounts were affected; the sources point to a post-mortem at gitbook.com for which customer data was accessible, which the text here does not include. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000712,"input_tokens":4791,"output_tokens":466,"severity_before":"critical","breached_checked":true},"analyst_status":null,"analyst_note":null,"search":"'/status/security-incident-2026-11-03)':93C '01m6fxddgqrwhmyywxy2req46x':13A 'access':46B,61B,107C 'account':175C 'action':162C 'affect':31B,141C 'apolog':122C 'app':9A,37B 'attack':49B 'ceo':197C 'co':202C 'co-found':201C 'communic':159C 'contact':173C 'cto':204C 'custom':43B,104C,114C 'data':44B,58B,105C 'disrupt':126C 'document':25B 'email':181C 'exact':102C 'explain':96C 'founder':203C 'full':76C,87C,100C 'gain':63B 'gitbook':1A,8A,12A,14A,15B,22B,36B,147C,196C,200C 'happen':98C 'help':166C 'highest':132C 'hold':128C 'hope':149C 'host':20B,24B 'impact':4A 'inc':11A 'inc-gitbook-01m6fxddgqrwhmyywxy2req46x':10A 'incid':3A,16B,30B,69C,84C,138C 'know':136C 'like':139C 'list':56B 'live':189C 'manag':176C 'mortem':79C,90C,156C 'next':120C 'pessé':199C 'place':145C 'platform':26B 'post':78C,89C,95C,155C 'post-mortem':77C,88C,154C 'previous':158C 'promis':65C 'protect':112C 'publish':5A,32B,74C 'question':172C 're':118C 'read':85C 'rebuild':167C 'recent':82C 'repli':178C 'resolv':39B,71C 'respond':110C 'sami':198C 'sara':194C 'say':42B 'secur':2A,17B,29B,83C 'self':19B 'self-host':18B 'site':6A,33B 'sourc':41B 'speak':183C 'standard':133C 'status.gitbook.com':192C,193C 'support':186C 'taken':165C 'tandowski':195C 'team':187C 'text':52B 'timelin':101C 'transpar':151C 'trust':143C 'updat':190C 've':73C,164C 'vendor':21B 'visit':191C 'www.gitbook.com':92C 'www.gitbook.com/status/security-incident-2026-11-03)':91C","nicknames":[],"mitigations":[],"who_affected":"GitBook customers whose published sites or GitBook app accounts were affected; the sources point to a post-mortem at gitbook.com for which customer data was accessible, which the text here does not include. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gitbook"],"ptokens":["gitbook"],"labels":["critical","gitbook","incident","security","selfhosted","vendor"],"campaign_type":null,"search_a":"'01m6fxddgqrwhmyywxy2req46x':13A 'app':9A 'gitbook':1A,8A,12A,14A 'impact':4A 'inc':11A 'inc-gitbook-01m6fxddgqrwhmyywxy2req46x':10A 'incid':3A 'publish':5A 'secur':2A 'site':6A","search_b":"'access':46B,61B 'affect':31B 'app':37B 'attack':49B 'custom':43B 'data':44B,58B 'document':25B 'gain':63B 'gitbook':15B,22B,36B 'host':20B,24B 'incid':16B,30B 'list':56B 'platform':26B 'publish':32B 'resolv':39B 'say':42B 'secur':17B,29B 'self':19B 'self-host':18B 'site':33B 'sourc':41B 'text':52B 'vendor':21B","search_c":"'/status/security-incident-2026-11-03)':93C 'access':107C 'account':175C 'action':162C 'affect':141C 'apolog':122C 'ceo':197C 'co':202C 'co-found':201C 'communic':159C 'contact':173C 'cto':204C 'custom':104C,114C 'data':105C 'disrupt':126C 'email':181C 'exact':102C 'explain':96C 'founder':203C 'full':76C,87C,100C 'gitbook':147C,196C,200C 'happen':98C 'help':166C 'highest':132C 'hold':128C 'hope':149C 'incid':69C,84C,138C 'know':136C 'like':139C 'live':189C 'manag':176C 'mortem':79C,90C,156C 'next':120C 'pessé':199C 'place':145C 'post':78C,89C,95C,155C 'post-mortem':77C,88C,154C 'previous':158C 'promis':65C 'protect':112C 'publish':74C 'question':172C 're':118C 'read':85C 'rebuild':167C 'recent':82C 'repli':178C 'resolv':71C 'respond':110C 'sami':198C 'sara':194C 'secur':83C 'speak':183C 'standard':133C 'status.gitbook.com':192C,193C 'support':186C 'taken':165C 'tandowski':195C 'team':187C 'timelin':101C 'transpar':151C 'trust':143C 'updat':190C 've':73C,164C 'visit':191C 'www.gitbook.com':92C 'www.gitbook.com/status/security-incident-2026-11-03)':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T05:16:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"gitbook:01M6FXDDGQRWHMYYWXY2REQ46X","url":"https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2REQ46X","severity":"critical","published_at":"2026-11-03T05:16:51+00:00","modified_at":"2026-11-04T19:49:42+00:00","first_seen_at":"2026-11-08T16:45:35+00:00","fetched_at":"2026-11-09T02:40:06+00:00","note":null}],"documents":[],"disclosures":[{"company":"GitBook","domain":"www.gitbookstatus.com","url":"https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2REQ46X","kind":"statuspage","published_at":"2026-11-03T05:16:51+00:00","quote":"The post explains what happened, a full timeline, exactly which customer data was accessible, how we responded to protect our customers, and what we’re doing next.","confidence":0.800000011920929,"source":"statuspage","created_at":"2026-11-08T16:52:08+00:00","entry":"unknown"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}