Leaked SendGrid API key — phishing via your domain

SendGrid keys let anyone send email as your domain. Attackers use leaked SendGrid keys to run phishing campaigns that pass SPF/DKIM/DMARC because they are actually sent from your infrastructure.