Notice history
Jul 2026
Jun 2026
May 2026
- PostmortemUTCPostmortemUTC
Composio security incident — May 21, 2026
On May 21, 2026, Composio — one of the integration providers Spinnable uses to connect to third-party services — experienced a security incident. Composio's own analysis indicates the affected scope was small (around 0.3% of customer connections globally, concentrated in GitHub, which Spinnable does not route through Composio).
Impact on Spinnable
We have no indication that any Spinnable accounts have been impacted. The connections that route through Composio (Gmail, Outlook, Asana, and similar) are stored on Composio's infrastructure, not ours — so our exposure tracked theirs. Integrations Spinnable provides through other MCPs or directly are not part of this incident.
We reviewed our access logs for activity from the attacker's known IP addresses across the incident window and found no evidence of unauthorized access to Spinnable systems.
What we did
Out of an abundance of caution, every affected connection in our project has been invalidated — either through Composio's own bulk-revocation effort, by per-connection revocation we ran through their API, or through direct credential rotation (X / Twitter) where Composio's revocation pathway was failing. Affected users were notified directly by email.
Timeline (UTC)
When
Event
May 21, 08:05–16:15
Composio incident window
May 23
Composio published their public disclosure and began bulk revocation
May 24
Spinnable forensic snapshot, per-connection revocation for our project, X (Twitter) client-secret rotation
May 26
Post-mortem published; status page updated
May 27
Spinnable emailed the affected users directly
What we've improved
Enabled 2FA on Spinnable's Composio dashboard account
Configured IP allowlisting on the Composio API key (a feature Composio rolled out as part of their incident response)
Reorganised our public status-page components to separate Spinnable services from subprocessors, so the same kind of upstream incident attributes correctly in future
Committed the response tooling (snapshot → resolve users → revoke → comms) to the Spinnable repo for faster future runs
Looking forward
For toolkits where token leakage would be high-impact, we're evaluating moving to bring-your-own OAuth credentials, which would give Spinnable a direct kill switch independent of subprocessor cooperation. We'll share updates as that work progresses.
Reference
Composio's full public disclosure: https://composio.dev/blog/composio-may-2026-security-incident
Questions or concerns: security@spinnable.ai
- ResolvedUTCResolvedUTC
This incident has been resolved. All tools should be working correctly after reconnection.
We will notify users by email in the coming day with more details about the causes and measures taken.
- MonitoringUTCMonitoringUTC
We implemented a fix and are currently monitoring the result. We will email users individually to explain the actions taken and the disruption they saw with some of their connected accounts.
- InvestigatingUTCInvestigatingUTC
We are currently investigating an incident with an upstream provider of tools for workers.