{
  "type": "bundle",
  "id": "bundle--217cd36a-ad7c-5684-81c9-af97a7bdf63b",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--31d85135-f459-560d-8214-c2e25d1f691e",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "org:a0e70c93-c212-4b38-aae0-b333dd80705b",
      "name": "GitBook",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--1a4093a5-c8d7-54a6-89aa-86492f7a30c9",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "brh:60092ca3-8de8-40f5-bd59-eae41d817dcc",
      "name": "GitBook SSO and production-access incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c65948d0-5195-56d1-8abf-83d44a059868",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "inc:76a8a5a5-3c89-4acc-b926-10ef48fc7688",
      "name": "GitBook SSO and production-access incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--096d193e-0469-5044-860d-0b18b7b5e11a",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:38892c31-95a2-4582-804d-fa9c679d673e",
      "relationship_type": "resulted-in",
      "source_ref": "incident--c65948d0-5195-56d1-8abf-83d44a059868",
      "target_ref": "x-ally-event--bd6568ca-1e37-5f8b-8089-478a53834a74",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:a1875907-50ff-49ed-89d8-75c0f4e5d6b4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55338c82-0628-5553-89a5-a275ca1912f1",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:3c66123b-9ea8-43a9-89d3-efc51749baa9",
      "relationship_type": "affected-organization",
      "source_ref": "incident--c65948d0-5195-56d1-8abf-83d44a059868",
      "target_ref": "identity--31d85135-f459-560d-8214-c2e25d1f691e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:6af9a495-89bb-4502-87d4-19aa9a67f89f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8abb4f74-dc8b-5860-810f-e35a7896c8be",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:b878dcbc-8e92-4a4f-847c-b0917c6ee4b2",
      "relationship_type": "resulted-in",
      "source_ref": "incident--c65948d0-5195-56d1-8abf-83d44a059868",
      "target_ref": "x-ally-event--3e4f096d-15d9-517b-8050-ca6d7edf40a4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:d5e978d5-5fdb-4490-8053-e0dea63e1273",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df001c4c-835d-5f9a-8acd-62cb1083958f",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:21a6fbdf-5dfc-4448-896b-df0c9aeaab73",
      "relationship_type": "resulted-in",
      "source_ref": "incident--c65948d0-5195-56d1-8abf-83d44a059868",
      "target_ref": "x-ally-event--4b788f94-4cfe-5741-879c-3e907b40559f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:166f81a4-b1e8-433c-b7a7-a5053a8b839e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--02096a5a-5d5f-5b56-8a2b-41ab22431b5b",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:40e37ce0-3076-4526-9da8-d4e4874a841e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:3534d036-de0d-408c-83a5-71f8156a7f99",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-02"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2b16856f-fd6b-5720-8d28-25a6738ffd27",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:dcdc981f-27e7-47c0-ba23-e88b8c45b778",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:c36a57d4-d3dd-4165-9705-0d45dec0905b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "GitBook fixed the SSO flaw, rotated production and integration keys, invalidated old API tokens and redeployed infrastructure. Customers were instructed to replace API tokens and rotate their own integration secrets and custom authenticated-backend signing keys."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4ecfbb6a-eba9-5cee-8608-e3e780cdcc72",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:93e14525-bf4a-4d0f-8fd9-6382b88ea1fd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:f2efbf86-7fa2-4bb2-8c97-1a9610dddbd9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "GitBook excluded billing information, passwords and IP addresses from the affected scope and reported no evidence of modification to other customers’ content. It could not determine actions in customer repositories accessible through authorized integrations."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5d93d5b1-4940-5ca9-866f-41af7296097f",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:a22cbc51-659b-4bc0-a246-a0e440f94589",
      "confidence": 95,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1190/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6eb165e4-ebbe-55ea-8e0c-91a7217bee75",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:39130123-32c8-4b58-b228-0dd8dca9a06e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:3c147f6b-8355-4660-badd-7ee6c2bdcaba",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-03"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--82e05514-c423-5a0a-8bc0-4b484e118622",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:f679b51f-8378-4560-8a86-ed8a8dfa6332",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:f1f18c00-1570-4b91-b500-300b2934fdf6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "GitBook treated all customer data as exposed, although it believed one customer was targeted. Potentially accessible material included API and integration secrets, session-signing secrets, Assistant questions and private documentation; this precaution does not establish that every item was copied."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--83621612-d679-5384-87ba-c4836dd67b82",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:bfe2634d-412f-41c5-92d9-7b0ff11ac145",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:e776dd8a-f4f9-4557-9c6f-b05111d90bdb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "An attacker exploited a single-sign-on login flaw to obtain GitBook staff sessions, then accessed GitHub App authentication information, internal code and a Cloudflare API key. The chain exposed production secrets and service-account access."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--adde4476-dba7-589e-80e7-3e6f47802f26",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:12f683cc-31d1-47e7-a1a8-9a2bea867b5a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:3f4823f1-e414-482b-85b5-04aab4dc9246",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Disabling compromised service accounts caused an application outage from 20:32 UTC November 2 until 11:56 UTC November 3, with some cached public documentation available. Production access also recurred briefly on November 3."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bdce1491-0162-5a5c-8432-e5550aaa5020",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:a886953d-41b1-4936-91e9-dbca5b16e0ae",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:448865b7-f00b-495b-91b0-508fd00fa6f8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-02"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d71db639-8fab-5987-8ccc-a38b3ae09b6e",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "clm:ca2cf3c3-ccb4-4cf6-b731-0b95f0d9b985",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "GitBook",
          "url": "https://www.gitbook.com/status/security-incident-2026-11-03",
          "external_id": "cit:db79f551-0e51-46b7-b6fe-0ded6c57a9f8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bedc51b4eaf6eae95095951a8c0db46f253aef2d6be911094a2dead0a904e2cc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-04"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--3e4f096d-15d9-517b-8050-ca6d7edf40a4",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "evt:b0ea4374-1b33-44f0-8e4e-804e7e5cb0e2",
      "name": "Staff sessions and production infrastructure accessed"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--4b788f94-4cfe-5741-879c-3e907b40559f",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "evt:f293810d-f9a8-4f7b-9f86-ed1c0e8a2b57",
      "name": "Postmortem published"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--bd6568ca-1e37-5f8b-8089-478a53834a74",
      "created": "2026-11-07T14:15:56.075794+00:00",
      "modified": "2026-11-07T14:15:56.075794+00:00",
      "x_ally_original_id": "evt:18cdf317-d8d0-4033-8cf4-ba03b26cb6bc",
      "name": "Application restored after credential rotation"
    }
  ]
}