Recently, my API (Just a Cloudflare Worker) was taken over by some sort of malware. Someone managed to create a new access token on my account and use it to create a secret secondary worker to affect all of my domains, injecting a fake CAPTCHA prompt in the center of the screen that made the unsuspecting visitor paste a command into the terminal.
Luckily, with my background in Cybersecurity and assisting the FBI multiple times, I traced down the person who did it. They're in Iceland, so not much I could do. But for everyone out there, please make sure you're storing your tokens SAFELY in SECRET ENVIRONMENTAL VARIABLES, and for vibecoders, DON'T PASTE API KEYS AND TOKENS willynilly.
