Narwhal Technologies Inc

Incident ID: INC-2026-001 Date Detected: 2026-01-29 09:00 UTC Date Contained: 2026-01-29 14:31 UTC Date Resolved: 2026-01-29 15:34 UTC Severity: High Status: Resolved ## Executive Summary A performance optimization to our log streaming infrastructure introduced a race condition that could cause log data from one CI pipeline execution to be incorrectly delivered to a different user's session. The issue affected production from January 26 19:08 UTC to January 29 15:34 UTC. One user report was received, and the fix was deployed within 6.5 hours of the report. At this time, we have no evidence that any sensitive information was exfiltrated or that this bug has been exploited by malicious parties. ## What Happened A performance optimization to our log streaming infrastructure introduced a race condition that could cause log data from one CI pipeline execution to be incorrectly delivered to a different user's session. Under certain timing conditions, when a background worker completed one streaming session and was reassigned to serve a new request, residual data from the previous session could be delivered to the new session. This occurred because the handoff between sessions lacked sufficient isolation. ## Timeline _All times in UTC_ - 2026-01-26 02:40 - Problematic code change merges into our Nx Cloud codebase - 2026-01-26 19:08 - First deployment of problematic version on…

We have made an update to our subprocessors list. - Anthropic has been added as a subprocessor for Nx Cloud. Users who opt into self-healing CI or other AI features may have some data shared with Anthropic. The full list of subprocessors can be found at https://security.nx.app/subprocessors at any time.