Following up on Phabricator, we were able to get some help with the forensics, and we’ve found no evidence that LLVM’s Phabricator instance was compromised. We’re not sure how else the SendGrid API key could have been compromised, so it remains a mystery.
This has given us enough confidence to bring up the Phabricator instance and scrape the missing differentials to complete the static archive of all the code review comments. The static archive should now be complete. Please report any gaps if you find them so we can address them.