Impact of Cloudbleed at HashiCorp
Following the public response by Cloudflare to the “Cloudbleed” incident, HashiCorp audited our use of the service to determine possible impact to our customers. HashiCorp does make use of various functionality provided by CloudFlare, including DNS resolution, but our use of the CloudFlare HTTP proxy feature is limited only to a small number of non-critical web properties. We’ve analyzed the use of those services and the data rendered during HTTP communication and are confident that they introduced minimal risk with no disclosure of personal information.
Importantly, the service atlas.hashicorp.com (aka “Terraform Enterprise”) was specifically not using the HTTP proxy feature so it remains unaffected.
We believe responsible analysis and disclosure is important to maintain trust in Internet-wide incidents like these, particularly given our DNS is resolved via the affected service provider.
Please direct any questions or concerns on this topic to support@hashicorp.com. As always, if you believe you have found a security issue in a HashiCorp web property or tool, please responsibly disclose by emailing security@hashicorp.com. Our security policy and our PGP key can be found at https://www.hashicorp.com/security
Sign up for the latest HashiCorp news
More blog posts like this one

Microsoft Azure and HashiCorp’s journey to 1 billion Terraform provider downloads
As we reach 1 billion Azure provider downloads, we reflect on nearly a decade of collaboration, community, and the growing impact of infrastructure as code on Azure.

Introducing HashiCorp Validated Patterns for product use cases
Read our field-tested approaches for using HashiCorp products and learn patterns built from thousands of customer engagements.

How IBM and HashiCorp are simplifying AI-ready hybrid cloud operations
Discover how IBM and HashiCorp are enabling secure, automated hybrid cloud environments built for the age of AI.