sk-1234 Is Not a Secret, It's a Docs Example, and 10% of You Shipped It Anyway
Nearly one in ten internet-facing LiteLLM gateways were running with the literal example admin key from the documentation still active. Not a weak k…
Team Management
⚑ Report a ProblemLatest Team Management news from Tech News
All topics
Culture
agents
ai
api
architecture
automation
beginners
career
devchallenge
devops
discuss
javascript
learning
llm
machinelearning
mcp
opensource
productivity
programming
python
react
saas
security
showdev
softwareengineering
startup
testing
tutorial
typescript
webdev
Your AI Coding Agent Will Run Whatever a Stranger's Repo Tells It To
Opening a folder shouldn't be a code execution vector. And yet here we are: an AI coding agent runs git status to "understand your project," and tha…
What Was on This Machine? Answering the Blast Radius Question After a Laptop Compromise
TL;DR: The containment clock starts immediately after a developer's laptop is compromised, an infostealer fires an alert, a device goes missing, or…
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
Junior AppSec Engineer Overwhelmed by Massive Code Reviews: Strategies for Efficiency and Confidence
Introduction: The Systemic Failure in Application Security Onboarding Consider the scenario of a junior Application Security Engineer tasked with se…
OAuth Tokens Were Always the Weak Link. AI Agents Just Made It Worse
Nobody phished anyone in the Vercel or Composio breaches. That's the part worth sitting with for a second, because for the last decade "security awa…
No, Claude Didn't 'Go Rogue.' Someone Gave It Root and Wi-Fi.
When an AI agent breaches a real system, the instinct is to ask "what's wrong with the model?" Wrong question. The right question, the one Anthropic…
Confronting Vault Sprawl And The Risks It Brings
Modern enterprises do not set out to create a maze of credentials, keys, and secrets stores. However, this is the reality most organizations find th…
282 AI Apps Are Handing Strangers Your API Bill — And Calling It a Product
The App Store Has an API Key Problem and "Move Fast" Culture Is to Blame Sixty-three percent of iOS AI chatbot apps studied are leaking secrets in n…
AI is shipping code faster than security was built to handle
AI coding tools have done something nobody planned for: they've made the security review cycle the bottleneck. Not CI. Not deployment. Security. Sny…
The Egregious Cost of Compliance: One Platform's Overly Broad Restrictions
The Problem We Were Actually Solving We were actually trying to solve the classic problem of onboarding new creators. We believed that by supporting…
We scanned 50+ MCP servers and found HIGH-severity bugs in Atlassian, GitHub, Cloudflare, and Microsoft — here's what we learned
MCPSafe (mcpsafe.io) runs automated security scans of Model Context Protocol (MCP) server repositories using a five-model LLM judge panel and a purp…
What Building a SAST Tool Taught Me About AppSec That 13 Years of Software Engineering Didn't
I've been writing software professionally since 2011. Java, C#, Kotlin, Node.js. Enterprise backends, microservices, APIs, data pipelines. I've ship…
SnowFROC 2026: Secure Defaults, Real Trust, and a Better Layer on Top
Denver likes a good origin story. The city still keeps a marker for Louis Ballast and the Humpty Dumpty Barrel, the local spot tied to the cheesebur…