Post Mortem:
The server I run Flotilla, zooid, and other things on got hacked this morning at about 5 AM Pacific. I had disabled the gitea action runner for pull requests, but not for users' own repo...
Respect for writing this up so openly. The point about keys that can't be rotated is the one more people need to hear. Most of us plan for the hack that never happens and skip the boring cleanup plan for the one that does. A self-revoke for NWC would be a big deal.