What happened?

We experienced a service incident affecting static asset delivery for all hosted sites. The incident occurred during a planned rollout of an enhanced security framework.

Starting November 3, 2026, at 11:30 AM UTC, websites remained available and continued to serve text content, but static assets such as CSS, images, and other files stopped loading. As a result, pages were displayed without their intended styling and media. Upon investigation, we identified that a newly introduced security policy unintentionally restricted access to the S3 storage bucket responsible for serving static assets, which prevented those files from being delivered to end users while the policy was active.

How quickly was it discovered?

The issue was detected within 5 minutes via our internal monitoring systems, which flagged that sites were loading only partially and were not rendering their full content.

How exactly was it handled?

After monitoring flagged the partial page loads, we investigated and traced the cause to the new security policy restricting access to the S3 bucket. We rolled back the policy, which immediately restored asset delivery and returned all sites to full functionality at 12:06 PM UTC.

What was the damage?

• Partial service degradation lasting approximately 36 minutes until full functionality was restored.
• Websites stayed online and served text content, but CSS, images, and other static files did not load, so pages were displayed without their intended styling and media.
• Asset delivery was affected for all users of the impacted sites during this window. No data was lost.

How do you improve now to prevent this from happening again?

Immediate changes:

• Rolled back the security policy that restricted access to the S3 bucket.
• Documented the incident in our internal knowledge base to support faster diagnosis and resolution of similar situations.
• Added a pre‑deployment check that verifies access to the static asset bucket before any security policy change goes live.

Long-term changes:

• Clearly defined roles and responsibilities for security policy changes among the responsible teams.

Do Partners need to do anything?

No action is required on your side.