Some things you set up in SIMCOAI are secrets we store on your behalf — the signing key that lets your own systems verify a webhook really came from us. Those were already encrypted, and remain so. We have now strengthened how the encryption key is derived, using the standard designed for the job rather than a simpler method, and each stored secret is cryptographically bound to the account it belongs to, so a copy of it cannot be made to work on any other account. We also added a key rotation path, and made the system refuse to store a secret at all if it is ever started without proper key material rather than falling back to something weaker.
Nothing is required from you and no secret needs regenerating. No secret was exposed and none of this was the result of an incident — it is work we did because it should have been done this way from the start.