I am impressed with the way Stack Overflow is handling this, but I would appreciate details about how a bug in the development tier gave an attacker the ability to escalate their access in production. Does the development tier have production keys? Did the attacker learn about some other bug through access to the development tier? Is the development tier sharing a privileged private network with the production tier? Hopefully the security community can learn from this incident to improve best practices.