An MSP posted to Reddit not long ago with a scenario that should unsettle every sysadmin who stores credentials in a SaaS documentation platform. A cluster of client passwords had been compromised. The only common thread: IT Glue. No corresponding access logs. No vendor alert. No smoking gun — just breached credentials and a platform that couldn't confirm or deny what happened on the backend.
That's the scenario that keeps security-conscious IT admins up at night: a silent breach with no customer-visible footprint.
Here's the uncomfortable truth — this isn't a hypothetical edge case anymore.
The Threat Is Real and It's Targeting SaaS Platforms
Attackers have shifted focus. Endpoints are hardened. Networks are segmented. But the SaaS tools organizations depend on for daily operations? Those are increasingly the target.
A long-running campaign dubbed "City-Forum" — detailed by Security News — specifically targeted Salesforce and ServiceNow to harvest credentials and sensitive business data. The same category of risk applies directly to IT documentation tools like IT Glue, Hudu, or Confluence. These platforms hold the keys to everything: client credentials, network diagrams, runbooks, firewall configs, and admin passwords.
According to The Hacker News, malicious LiteLLM releases tied to the Trivy hack silently harvested cloud keys, SSH keys, and database passwords — affecting 2,100+ organizations before anyone noticed. That's the defining feature of these attacks: they're designed to be invisible. No alerts. No anomalous login entries. No obvious trail for the victim to follow.
And it's not just credential theft. According to The Hacker News, a flaw in major AI provider APIs allowed API keys and passwords to be recovered from session logs — reinforcing the specific fear from the IT Glue Reddit post that credentials stored in a SaaS backend can be silently exposed without any visible access logs on the customer side. You may never see it in your audit trail. The exposure happens at the vendor layer.
Authentication weaknesses compound the problem. The Hacker News reported active exploitation of a SharePoint authentication bypass after a public proof-of-concept was released — before most customers were even aware the vulnerability existed. Widely trusted collaboration and documentation platforms are not immune. They're targets.
Warning Signs Your Documentation Tool May Have Been Compromised
Because logs often won't tell you, you have to watch for indirect signals:
- Credential cluster failures: Multiple accounts failing authentication in a short window, especially across different clients or systems
- Impossible travel or off-hours logins: Access to systems using credentials that are only stored in your documentation platform, at times no one on your team was working
- Password reuse exploitation: Breaches appearing on accounts where the only shared attribute is the password stored in your doc platform
- Vendor silence: No breach notification, but anomalous behavior in client environments pointing back to stored credentials
- New API tokens or OAuth grants: Unfamiliar integrations appearing in your documentation tool's connected apps list
If you're seeing a cluster of credential-related incidents with no clear endpoint compromise, your documentation platform has to be on the suspect list.
Immediate Incident Response Steps
1. Assume compromise, act immediately Don't wait for vendor confirmation. If the pattern suggests your documentation tool is the common thread, treat it as a confirmed breach and move.
2. Rotate every credential stored in the platform Start with the highest-privilege accounts: domain admin, firewall admin, cloud console root, backup infrastructure. Then work down the list. Yes, all of it. Our guide to password manager breach 24-hour incident response covers the rotation priority order in detail.
3. Revoke and reissue API keys and tokens Any API key, service account token, or OAuth credential stored in the documentation platform should be considered burned. Revoke them. Generate new ones. Update integrations.
4. Enable or review MFA on the documentation platform itself If your IT Glue or equivalent doesn't have MFA enforced for every user, fix that now. Also audit which users have access — remove anyone who shouldn't.
5. Pull your access logs anyway Even if logs are incomplete or show nothing, document what you checked and when. This matters for cyber insurance claims, client notifications, and any regulatory reporting obligations.
6. Notify affected clients If you're an MSP, your clients' credentials were in that platform. They need to know. Have a communication template ready. Transparency now is far less damaging than a client discovering it independently later.
7. Evaluate your documentation platform's security posture Ask hard questions: Does the vendor offer audit logs you can export? Do they publish a SOC 2 report? What's their breach notification policy? If you can't get clear answers, that's a risk you need to document and potentially act on.
For MSPs specifically, this is also a good time to revisit your internal security posture — our MSP internal security checklist covers the controls that protect your own infrastructure, not just your clients'.
The Structural Problem With SaaS Credential Storage
The IT Glue Reddit incident exposes a fundamental tension: IT documentation tools are extraordinarily useful precisely because they centralize everything. But centralizing everything creates a single point of catastrophic failure if the vendor's backend is compromised.
This doesn't mean you should stop using documentation platforms. It means you need layered controls:
- Minimize what you store: Don't store credentials you can retrieve on-demand from a PAM solution or secrets manager
- Use break-glass accounts sparingly: Not every admin password needs to live in the doc platform
- Segment by client: Ensure your platform's access controls prevent one compromised account from seeing all client records
- Monitor for credential use anomalies: If a stored password is used from an unexpected location, you need to know
This connects directly to the broader risk of accidental credential exposure through third-party integrations — a risk that compounds when your documentation platform is also integrated with your RMM, PSA, and ticketing system.
You Can't Rely on the Vendor to Tell You
The hardest part of the IT Glue scenario isn't the breach itself — it's the silence. No notification. No log entry. No confirmation. You're left making decisions based on circumstantial evidence while the clock runs on credential exposure.
That's why proactive visibility into your own environment matters more than ever. Waiting for a vendor to tell you something went wrong is not a security strategy.
Take Action
If a silent breach of your documentation platform started today, would you catch it before your clients did?
Proactive scanning catches exposed credentials, misconfigured access controls, and vulnerable integrations before attackers exploit them. Oscar Six Security's Radar gives small businesses and MSPs an affordable way to stay ahead of these risks — at $99 per scan, it's built for organizations that can't afford a full-time security team but can't afford a breach either.
Focus Forward. We've Got Your Six.