A security update from omg.dev
On 1 November, an attacker got into one of our servers. We stopped them on 2 November. Here is what we can share now.
Last updated November 3, 2026
Why this happened
Over time, omg.dev has changed a lot to better fit what our users need. Along the way, we kept some older systems and features running after we stopped needing them, and they were not locked down the way they should have been. We believe the attacker got in through these legacy systems.
What we are doing
- Removing legacy systems and features. We are shutting down the old parts of the platform that we no longer need. Anything that stays has to meet the standard we hold our newer systems to.
- Strengthening our security. We are tightening who and what can reach our servers, and improving how quickly we spot and respond to problems.
- Contacting affected users. If we believe your account or your projects were affected, we email you directly with the steps that apply to you.
If we could not reach you
We could not reach some customers by email. For example, some of you signed up with a private relay address, such as Apple’s Hide My Email, or with an address that no longer receives mail. If you are concerned about your account or your projects, please contact us at [email protected], and we will look into it with you.
Stay alert to fake emails
Be careful with unexpected emails that claim to be about omg. We only write to you from omg.dev addresses, and we will never ask for your password or your keys. If a message looks wrong, forward it to [email protected] before you click anything.
Talk to us
If you have questions or concerns, please reach out. We read every message.
- Customers with questions about their account: [email protected]
- Security concerns, or to report a vulnerability: [email protected]