Yesterday, we released our Security Incident Report, a comprehensive review of the September AWS root-access event. The report reflects both independent and internal analysis, outlining what occurred, what was verified, and the actions we’ve taken to strengthen our systems and practices.
All RubyGems.org services remain stable, secure, and operational.
The triggering event revealed weaknesses in credential management practices, which we have corrected. All credentials have been rotated and are further protected with MFA.
We’ve also strengthened operational coverage by adding two new maintainers to our on-call rotation to improve resilience and response capacity.
In our efforts to further strengthen operational resilience, we are opening up opportunities for additional community participation in operations through structured volunteer support from trusted individuals and companies. Specifically, through Ruby Central’s Corporate Contributor Stewardship Program, companies commit in-kind engineering time to work with our team on priority maintenance, reliability, and security tasks across RubyGems, Bundler, and RubyGems.org. Ruby Central coordinates onboarding, scope, and review so contributors can plug in quickly and safely. To learn more, reach out to
[email protected].
