Botpress disclosed on November 6, 2026 that an intruder used a flaw in an internal authentication proxy and an employee API credential to read bot configurations in 16 customer workspaces. The configurations can hold third-party credentials, and integration settings were changed in two additional workspaces. Authentication Flaw Preceded Workspace Access On October 12, 2026, someone began probing the authentication proxy protecting several internal tools. A flaw in its sign-in validation allowed…