700 Agents, 25 Actions Each, and Nothing Fired
Somewhere in your SIEM there's a rule that fires when one account does too much, too fast. Every threshold like it is a quiet bet that the attacker…
Последние новости Web от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Your AI Agents Are Using Your Credentials
Key findings It's a secrets problem before it's an identity problem. Many AI agents don't have their own distinct identity, so they operate using AP…
Vault Coverage Is the Missing Metric in NHI Programs
Most large enterprises have some version of a vault program, the combination of policy, platform, process, and ownership used to manage machine cred…
What Was on This Machine? Answering the Blast Radius Question After a Laptop Compromise
TL;DR: The containment clock starts immediately after a developer's laptop is compromised, an infostealer fires an alert, a device goes missing, or…
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
Куда на самом деле попадает секрет при сборке Docker-образа: разбираем 8 способов
Секрет попал в Dockerfile, разработчик спохватился и добавил RUN rm. Файла в контейнере больше нет — значит, всё в порядке? Нет: строку по-прежнему…
Responding to Exposed Secrets - An SRE's Incident Response Playbook
Responding to Exposed Secrets - An SRE's Incident Response Playbook Today, let's take a closer look at incident response playbooks: how to build one…
Your Secrets Need a VDP, Not Just a Bug Bounty
Your Secrets Need a VDP, Not Just a Bug Bounty Bug bounty programs are valuable -- until they replace disclosure policies. Learn how unreasonable Po…
Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern
Docker has switched on OpenID Connect authentication between GitHub Actions and Docker Hub, letting a workflow exchange a signed per-run identity to…
Copilot CLI drops the PAT requirement inside GitHub Actions
GitHub said this week that Copilot CLI, when it runs inside a GitHub Actions workflow, will accept the built-in GITHUB_TOKEN for authentication. Per…
BurnAfterRead – E2E encrypted self-destructing drops on Cloudflare Workers
I built a zero-knowledge secret sharing tool. Text and files are encrypted in the browser with AES-GCM 256 before upload - the server only ever sees…
Secret Scanning in CI: What Pre-Commit, Pull Request, and Main Branch Each Actually Catch
A teammate pastes an AWS access key into a PR comment to "debug quickly." Another commits .env.production because .gitignore was wrong on a new micr…
Day 26 - HashiCorp Vault & Secrets Management
Modern applications depend on secrets. Every application requires: Database Passwords API Keys SSH Keys TLS Certificates Cloud Credentials OAuth Tok…
NHI Governance Is the Outcome. GitGuardian Is How You Get There
There is a category mistake that happens all the time in the non-human identity (NHI) market. People talk about governance as if it were a box you b…
Gitlfow Secrets Management
Opening Someone had rotated the API keys manually — without telling anyone. The rotation got lost in Slack three days ago. Now we had 47 repositorie…