GitBook Kills Every Personal API Token After Breach Hit Its Docs Platform

GitBook pulled the plug on every personal API token after someone got inside its infrastructure on Nov. 2. In a Nov. 3 disclosure, the documentation platform said the attacker may have walked off with integration tokens, Git Sync secrets, API tokens and questions that visitors typed into GitBook Assistant. So far, no sign that customer content got altered.

The company called it a sophisticated, highly targeted attack using AI agents, but stayed quiet on how those agents were deployed or how the intruder grabbed the credentials in the first place. It pinned the unauthorized infrastructure access at 1 p.m. ET on Nov. 2. Since then, GitBook says it blocked the attacker, shut the holes, and swapped out every credential and secret across its infrastructure.

Customers aren't off the hook. GitBook told them to rotate third-party API tokens and secrets wired into its platform, replace secrets used in published integrations, and re-authenticate the GitBook MCP server. The app and authenticated docs went dark during the cleanup, with public pages kept alive on cached data as long as possible. By the Nov. 3 update, the app, API and published documentation were back, though a few services may still be limping.

Other projects caught the shrapnel fast. Hyperliquid-based trading platform Trade.xyz said on Nov. 2 it spotted unauthorized activity on its GitBook docs that morning and had them restored to their previous state by 9:15 a.m. ET, warning users not to click any links in the docs while the investigation runs. That restoration time lands before GitBook's stated infrastructure-access time, and the statements don't say whether the two incidents are linked.

Unit suspended access to its own GitBook page as a precaution and gave users the same advice about avoiding doc links. PancakeSwap said its documentation was never compromised and its app untouched, but yanked its docs anyway. On Nov. 3, the DEX said it had moved its documentation off GitBook onto infrastructure it controls, with old links still working.

GitBook says a full post-mortem with more detail is coming.