Impact of Cloudbleed at HashiCorp

Impact of Cloudbleed at HashiCorp

Mar 02 2017    Jack Pearkes

Following the public response by Cloudflare to the “Cloudbleed” incident, HashiCorp audited our use of the service to determine possible impact to our customers. HashiCorp does make use of various functionality provided by CloudFlare, including DNS resolution, but our use of the CloudFlare HTTP proxy feature is limited only to a small number of non-critical web properties. We’ve analyzed the use of those services and the data rendered during HTTP communication and are confident that they introduced minimal risk with no disclosure of personal information.

Importantly, the service atlas.hashicorp.com (aka “Terraform Enterprise”) was specifically not using the HTTP proxy feature so it remains unaffected.

We believe responsible analysis and disclosure is important to maintain trust in Internet-wide incidents like these, particularly given our DNS is resolved via the affected service provider.

Please direct any questions or concerns on this topic to support@hashicorp.com. As always, if you believe you have found a security issue in a HashiCorp web property or tool, please responsibly disclose by emailing security@hashicorp.com. Our security policy and our PGP key can be found at https://www.hashicorp.com/security.html

close modal

Request a Demo

Fill out the form below and we'll reach out to discuss a product demo.

check mark
check mark
check mark
check mark
Select an option
  • Select one
  • Terraform
  • Nomad
  • Vault
  • Consul
Trusted by
  • Adobe Logo
  • Barclays Logo
  • Cisco Logo
  • Citadel Logo
  • DigitalOcean Logo
  • Hewlett Packard Enterprise Logo
  • SAP Arabia Logo
  • New Relic Logo
  • Pinterest Logo
  • Segment Logo
  • Spaceflight Logo
  • Stripe Logo