The fixed skill doesn't touch apps that were already built. Search repos, render.yaml/blueprints, .env files and Render environment-variable settings for render-internal.com. The skill also showed the database form postgres.render-internal.com:5432, so check DATABASE_URL-style strings too. Replace each hit with the internal hostname Render actually gives you, for example through fromService/fromDatabase references. If you have DNS or egress logs from Jan 27 to mid-August 2026, look for lookups of *.render-internal.com. Any token, API key or DB password an app sent to that host should be treated as exposed and rotated, even though the domain is now held by Render. More broadly, add a review step that resolves and checks ownership of every external domain an agent skill or plugin writes into code.