Your Vendor's Breach Is Your Problem Too

The tools you trust are only as safe as the vendors behind them

Modern products run on a chain of vendors. When one link breaks, the damage reaches people who never knew that vendor existed, as Notion users recently found out.

What happened

A security incident at Fireworks AI, an AI inference vendor, exposed some Notion AI chat sessions. Notion says the chats were not labeled with who wrote them, and only a small share of workspaces were involved. Notion cut the connection, deleted its data there and advised users to change any keys or passwords pasted into the assistant.

You can read the details in reporting from The Register and ComplexDiscovery.

Why this matters beyond Notion

Even a strong team can be exposed through a vendor it depends on, so vendor choices are security choices.

What smart tech teams do differently

• Treat every vendor as part of your attack surface.

• Keep secrets out of chat tools. Use a secrets manager instead.

• Rotate keys on a schedule and limit their permissions.

• Read the contract so you know what a vendor must tell you after an incident.

It always comes back to people

At Workfall, we connect companies with developers and teams who bring both skill and care. Find talent through Hiring or Dedicated Teams, or explore Workfall Agencies.

Build your team with Workfall.

Frequently Asked Questions

Q1:What is AI vendor risk?

It is the chance that a security problem at an AI or software provider you rely on exposes your data, your customers or your systems.

Q2:Should teams paste API keys into AI tools?

No. Keys and passwords belong in a secrets manager. Anything pasted into a chat tool may be stored somewhere you do not control.

Q3:How can companies hire developers who care about security?

Look for habits, not just tools: how candidates handle secrets, review code and question integrations. Workfall helps companies find developers and teams with that mindset.