Removed: nothing. Long-lived customer secrets — OAuth tokens and API keys — were stored in the service and exposed with it.
Outcome: customer OAuth tokens and API keys left the service with it. Organizations using short-lived credentials had significantly less exposure.
The CircleCI security incident of 2023 exposed customer secrets including OAuth tokens and API keys stored in their systems.
Source: CircleCI, January 4, 2023 security alert (4 January 2023)