Blog

Why your AI coding agent should never see your API keys 2026-08-15
.env files vs secret managers: when to stop using env files 2026-08-16
Agent config files are the new .env: secrets in Claude settings and opencode.json 2026-08-16
Agent tool output hygiene: when the agent's own tools leak secrets 2026-08-16
AI agent audit logs and compliance: what to record for SOC 2 2026-08-16
AI agent permission models: allowlists, sandboxes, and credential gates 2026-08-16
AI agents need access, not keys: the principle behind credential brokers 2026-08-16
AI coding agent security checklist: 15 checks before you trust one 2026-08-16
AI in your terminal: where secrets hide in agent workflows 2026-08-16
Aider secret management: CLI agent patterns 2026-08-16
API keys vs OAuth tokens for AI agent integrations 2026-08-16
Attestation, SBOM, and supply chain: what to verify before installing 2026-08-16
Audit logging best practices: what to log and why 2026-08-16
Auditing AI agent activity: structured logs for credential access 2026-08-16
Automating agent logins: from OAuth to ssh-agent 2026-08-16
Bitwarden CLI automation: session keys, unlock, and scripts 2026-08-16
Bitwarden CLI session keys: the BW_SESSION footgun in agent automation 2026-08-16
Building a DLP pattern layer: keyword pre-filter, RE2, and entropy 2026-08-16
Canary tokens for AI agents: detecting exfiltration early 2026-08-16
Centralized logging for agent activity: self-hosted options 2026-08-16
Choosing a secret store for AI agents: decision guide 2026-08-16
Claude Code secret management: moving from .env to a password store 2026-08-16
Claude Code settings.json: secure configuration patterns 2026-08-16
Claude Code vs OpenCode: security posture compared 2026-08-16
Client credentials grant for machine-to-machine: when it fits agents 2026-08-16
Cloudflare Pages + Hugo: a free static site stack 2026-08-16
Container security basics: images, scanning, and runtime 2026-08-16
Cosign keyless signing: verifying artifacts without a keypair 2026-08-16
Credential access monitoring: the control auditors actually check 2026-08-16
Credential brokers for AI agents compared: 2026 edition 2026-08-16
Cursor and AI IDE agents: secret hygiene for GUI agents 2026-08-16
Data exfiltration via AI agents: paths you haven't considered 2026-08-16
Data loss prevention 101: what DLP actually detects 2026-08-16
Data retention for AI agent logs: balancing audit and privacy 2026-08-16
Defense in depth against prompt injection: layers, not luck 2026-08-16
Device authorization flow security: risks and mitigations 2026-08-16
DLP for LLM API traffic: scanning outbound requests for secrets 2026-08-16
DNS security practices: DNSSEC, CAA, and lock 2026-08-16
dotenv and friends: why your .env loader is a security risk 2026-08-16
Dotfiles and agent configs: secrets hiding in plain sight 2026-08-16
Environment variable leaks in AI tool output: the base64 trap 2026-08-16
Forensics on agent logs: reconstructing what an agent did 2026-08-16
Gitleaks tutorial: scanning repos, CI, and beyond 2026-08-16
Go single binary deployment: why it wins for CLIs 2026-08-16
go:embed: bundling assets and rule sets into binaries 2026-08-16
golangci-lint setup: a practical baseline 2026-08-16
Google API access from the CLI: device flow setup 2026-08-16
GPG key management for developers: avoiding the lockout 2026-08-16
How to keep API keys out of your AI coding agent's context window 2026-08-16
Hugging Face agents and secrets: tokens in the hub ecosystem 2026-08-16
Incident response for AI agent compromises: a runbook 2026-08-16
Indirect prompt injection: when web content becomes instructions 2026-08-16
Isolating agent sessions from production credentials 2026-08-16
Jailbreaking LLM agents: what security researchers actually break 2026-08-16
journald vs JSONL file logging: choosing your audit sink 2026-08-16
JWT security: verifying claims without a framework 2026-08-16
Killing your .env files: a zero-friction migration path 2026-08-16
Kubernetes secrets for AI agents: overkill or essential 2026-08-16
LangChain and LlamaIndex credentials: framework-level secret handling 2026-08-16
LLM gateway security: routing, keys, and audit 2026-08-16
LLM prompt leakage: what your model API requests reveal 2026-08-16
Log poisoning attacks on AI agents: rewriting history 2026-08-16
Masking vs blocking in DLP: which to deploy first 2026-08-16
MCP authentication patterns: OAuth, API keys, and headers 2026-08-16
MCP server security: reviewing servers before you connect 2026-08-16
MCP servers and secrets: where your keys actually live now 2026-08-16
Multiple AI agents, one credential store: sharing secrets safely 2026-08-16
Network segmentation for developer machines: practical isolation 2026-08-16
OAuth 2.0 explained: tokens, scopes, and flows in plain terms 2026-08-16
OAuth device flow explained: how CLIs and AI agents approve access 2026-08-16
OAuth scopes and least privilege: right-sizing agent permissions 2026-08-16
OAuth tokens for AI agents: device flow and rotating refresh tokens 2026-08-16
OpenAI Codex secret management: keeping keys out of the CLI agent 2026-08-16
OpenCode + pass: injecting credentials without exposing them to the agent 2026-08-16
OpenCode config security: agents.yaml and environment 2026-08-16
pass for developers: the 10 commands you actually need 2026-08-16
pass vs 1Password for agent workflows 2026-08-16
pass vs Bitwarden for AI agent credentials: which works with agents 2026-08-16
Password store vs secret vault: picking your threat model 2026-08-16
Prevention fails: making secrets actually disappear from session databases 2026-08-16
Prompt injection and API key exfiltration: what actually happens 2026-08-16
Prompt injection mitigations ranked: from filtering to structure 2026-08-16
Prompt injection through tool calls: the MCP attack surface 2026-08-16
Prompt injection types: direct, indirect, and multi-turn 2026-08-16
Refresh token security: rotation, reuse detection, and storage 2026-08-16
Reproducible builds in Go: hashing the same output twice 2026-08-16
Rotating API keys when an agent has seen them: a practical playbook 2026-08-16
Running local LLMs: why you still need DLP for agent traffic 2026-08-16
Sandboxing agents vs credential brokers: complementary, not competing 2026-08-16
SBOMs explained: what's in them and how to read one 2026-08-16
Scanning logs for secrets: retroactive detection at scale 2026-08-16
Secret rotation strategy: automated, scheduled, and emergency 2026-08-16
Secret sprawl on developer machines: an audit guide 2026-08-16
Secrets in Docker: from --env-file to docker secrets 2026-08-16
Secrets in git history: finding and erasing them 2026-08-16
Self-hosted coding agents: secret hygiene for your own infrastructure 2026-08-16
Self-hosted LLM infrastructure: securing model endpoints 2026-08-16
Server hardening basics: what I do on a fresh VPS 2026-08-16
Service accounts vs OAuth for agents: choosing the right identity 2026-08-16
Shannon entropy in secret detection: the math behind the threshold 2026-08-16
SOC 2 and AI agents: what auditors will ask about 2026-08-16
SQLite forensics: why deleting rows doesn't erase secrets (FTS, free pages, VACUUM) 2026-08-16
SSH keys and secret management: the overlap nobody talks about 2026-08-16
Static analysis for Go security: govulncheck and friends 2026-08-16
systemd service hardening: sandboxing unit files 2026-08-16
The AI agent secret-management landscape: tools and gaps 2026-08-16
The Go race detector: finding data races in CLI tools 2026-08-16
The ssh-agent lesson: why AI agents should use credential brokers 2026-08-16
Token expiry handling in automation: the silent breaker 2026-08-16
Using gitleaks rules to detect API keys in your own outbound traffic 2026-08-16
VS Code AI extensions and secrets: what Copilot can see 2026-08-16
What is a credential broker for AI agents (and why you need one) 2026-08-16
What's actually in your agent's context window: secrets you didn't know were there 2026-08-16
Why every AI agent setup needs an egress proxy 2026-08-16
Why minimal dependencies matter for security tools 2026-08-16
Why your agent isn't a REPL: the threat model difference 2026-08-16
Writing regexes that catch API keys without false positives 2026-08-16
Open-source credential tools for developers: 2026 roundup 2026-08-17
Self-hosting security tools: cost, maintenance, and payoff 2026-08-20
Getting started with AI agent security: a 30-minute primer 2026-08-24
CLI tools for secret hygiene: your terminal security stack 2026-08-27
API key callbacks: the leaked-key alarm you should wire up 2026-08-31
Prompt caching and secrets: where your context goes to sleep 2026-09-07
RAG pipeline security: secrets in embeddings and vector stores 2026-09-10
Model API access control: per-key limits, budgets, and alerts 2026-09-14