The attack did not need an exploit. It needed a key.
Brevo (formerly Sendinblue), the French marketing platform, confirmed in a post-mortem published September 17, 2026: attackers stole a long-lived Cloudflare API key embedded in code and used it to rewrite JavaScript at the edge, injecting malicious ClickFix scripts into customer sites. Up to 100,000 sites affected, over 5 hours of exposure, with a WordPress backdoor in the chain per the analyses.
The perimeter changed addresses
The classic perimeter (firewall, network edge, DMZ) became irrelevant to this vector: nobody broke into Brevo. Someone used a legitimate credential of a legitimate service to rewrite content delivered at mass scale.
It is the same thesis the out-of-authorization agent cases imposed on AI: filtering the gate is insufficient; what decides is who holds a key and what the key reaches. The API key is the new perimeter because today it reaches what the old perimeter protected: the content the client receives.
The antipattern’s anatomy
The case has three ingredients, all manageable:
- A key embedded in code: hard-coding in production is the central antipattern. A versioned credential is a delivered credential, and versioning is eternal.
- Mass scope and eternal life: a key that rewrites the edge JavaScript of 100,000 sites should not exist. Mass privilege without expiry turns key theft into a chain event.
- No monitoring at the destination: the injector worked for over 5 hours. Anyone delivering scripts to third-party sites must monitor what arrives there: asset integrity, change alerts, SRI where the design allows.
None of the three requires exotic technology. All three require credential governance with the same rigor as human credentials: inventory, scope, short life, and anomalous-use alerts.
The third party’s third party
The case’s final victim was not a Cloudflare customer: they were a Brevo customer using Cloudflare. It is the chain’s fourth participant in the credential version: the risk lives in the key your vendor holds, and you do not audit.
The question for every vendor touching production (and for every script your site loads) becomes direct: how do you store the keys that reach my environment, what is their scope, and how do they rotate? It is the same due diligence the core banking case imposed, applied to the credential.
The checklist the case leaves
- Key inventory: every key in the operation, who owns it, what it reaches, where it lives.
- Minimum scope and short life: no mass privilege without expiry; automatic rotation independent of deploys.
- The end of hard-coding: managed vault and runtime-injected secrets, including in the pipeline.
- Destination monitoring: integrity of assets delivered to third parties and change alerts, with CSP and SRI where possible.
- Vendor credential due diligence: the key question, asked before the incident.
Conclusion
The Brevo case proves the credential beat the exploit as the chain vector: one key, one edge, one hundred thousand sites.
The answer is administrative before technological: inventory, scope, short life, and destination visibility. Every operation has the key it does not know the location of; the case shows what it is worth in the hands of whoever finds it. Inventorying yours is this week’s work.