I think my app was hacked: what to do first

By Shinobi Tech, the team behind AppLeakWatch. Updated .

Save your evidence, shut the way in, then replace every key the app uses. After that, work out what was reached and whether you must tell anyone. Don't delete logs or quietly wipe things first, because you'll need them.

Why this happens

The first hour shapes everything after it. Moving fast matters, but deleting evidence can leave you unable to tell who was affected.

How to check

  1. Save logs from your host, database and payment provider.
  2. Write down what you saw and when.
  3. Look for new admin users, changed data, new API keys and odd bills.
  4. Note which customer data could have been reached.

How to fix it

  1. Close the way in: turn on database rules, remove exposed files and consider taking the app offline.
  2. Replace keys and passwords for your database, payment, email and AI providers.
  3. Sign everyone out by rotating session secrets.
  4. Get legal advice on notifying people. Many privacy laws set short deadlines. GDPR, for example, can require telling the regulator within 72 hours.
  5. Fix the cause, scan again and keep watching.

Prompt for your AI tool

I may have a security incident. Without deleting any logs or data, list every secret this app uses and where each is set, every place that accepts data without a login, and every table that's publicly readable. Then give me an ordered plan to close each one.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Can AppLeakWatch tell me if I was breached?

No. It shows what's exposed now, not who has already looked. Your logs are the best evidence.

Do I have to tell my users?

It depends on where you and they are and what was exposed. Ask a lawyer quickly.

Related guides