Touch ID умеет больше, чем вы думали
Лично у меня пароль на sudo был отключён, SSH-ключи были незашифрованы, а секреты для переменных окружения хранились открытым текстом в ~/.zshrc , п…
AI & ML
⚑ Report a ProblemLatest AI & ML news from Tech News
All topics
AI
News
Tech
agents
ai
api
architecture
automation
backend
beginners
career
claude
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
700 Agents, 25 Actions Each, and Nothing Fired
Somewhere in your SIEM there's a rule that fires when one account does too much, too fast. Every threshold like it is a quiet bet that the attacker…
Your AI Agents Are Using Your Credentials
Key findings It's a secrets problem before it's an identity problem. Many AI agents don't have their own distinct identity, so they operate using AP…
Vault Coverage Is the Missing Metric in NHI Programs
Most large enterprises have some version of a vault program, the combination of policy, platform, process, and ownership used to manage machine cred…
What Was on This Machine? Answering the Blast Radius Question After a Laptop Compromise
TL;DR: The containment clock starts immediately after a developer's laptop is compromised, an infostealer fires an alert, a device goes missing, or…
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
Responding to Exposed Secrets - An SRE's Incident Response Playbook
Responding to Exposed Secrets - An SRE's Incident Response Playbook Today, let's take a closer look at incident response playbooks: how to build one…
Your Secrets Need a VDP, Not Just a Bug Bounty
Your Secrets Need a VDP, Not Just a Bug Bounty Bug bounty programs are valuable -- until they replace disclosure policies. Learn how unreasonable Po…
Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern
Docker has switched on OpenID Connect authentication between GitHub Actions and Docker Hub, letting a workflow exchange a signed per-run identity to…
Blast Radius: What a Leaked Secret Breaks
Why identity-local signals and topology signals are two layers of the same blast radius The credential with the widest blast radius sometimes has no…
Copilot CLI drops the PAT requirement inside GitHub Actions
GitHub said this week that Copilot CLI, when it runs inside a GitHub Actions workflow, will accept the built-in GITHUB_TOKEN for authentication. Per…
BurnAfterRead – E2E encrypted self-destructing drops on Cloudflare Workers
I built a zero-knowledge secret sharing tool. Text and files are encrypted in the browser with AES-GCM 256 before upload - the server only ever sees…
Secret Scanning in CI: What Pre-Commit, Pull Request, and Main Branch Each Actually Catch
A teammate pastes an AWS access key into a PR comment to "debug quickly." Another commits .env.production because .gitignore was wrong on a new micr…
Day 26 - HashiCorp Vault & Secrets Management
Modern applications depend on secrets. Every application requires: Database Passwords API Keys SSH Keys TLS Certificates Cloud Credentials OAuth Tok…
NHI Governance Is the Outcome. GitGuardian Is How You Get There
There is a category mistake that happens all the time in the non-human identity (NHI) market. People talk about governance as if it were a box you b…
Gitlfow Secrets Management
Opening Someone had rotated the API keys manually — without telling anyone. The rotation got lost in Slack three days ago. Now we had 47 repositorie…