As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes. On September 30th, a blog post raised concerns that a former maintainer continued to have access to the RubyG

