Security help
What to do if you suspect someone gained access or data was exposed, and how to report it safely without sharing secrets.
Stop the affected activity first
Stop the affected client or automation from submitting more work if you suspect access or data exposure. Record the time and the safe reference already available. You may have shared a credential, seen unexpected access, or found content where it should not appear.
Do not share the secret again to demonstrate the problem. Do not test another account, inspect a provider's private files, or delete useful evidence.
Use the correct access control
For a Compute key, open API keys in the correct account. Review the key label and visible prefix, choose its revoke action, and confirm the exact key. Check the refreshed state for a confirmed revocation.
If the action fails or its response is lost, revocation is not confirmed. Ask the account owner or Lithi for help. A source connection, destination connection, device identity, or portal session has a separate owner and recovery path. Revoking a work key does not prove those other permissions ended.
Keep work and data outcomes separate
Read existing work through an authorized unaffected identity. A request to cancel is not proof that every in-flight operation stopped. Access expiry does not prove erasure, and revocation cannot recall a copy already delivered.
Do not create replacement work while an earlier submission is unresolved. Record which access was changed and which job or delivery outcomes still need reconciliation.
Report privately
For a suspected vulnerability or exposure, follow Report a security issue. For ordinary account recovery, use Contact Lithi.
Include the product, affected boundary, safe error code or reference, and observation time. Leave out keys, cookies, signed URLs, bank details, private messages, and full customer files. A support acknowledgment is not confirmation that an incident is resolved. Resume only when the affected access and required security checks are confirmed.