Secrets
20 guides tagged “Secrets”.
- How to Rotate Credentials an Agent Can Reach Inventory what the agent can read, issue short-lived credentials, rotate on a schedule and after any suspicion, and verify the old one is dead.
- How to Keep Secrets Away From an AI Coding Agent Remove secrets from the agent's reach: no .env in the workspace, scoped tokens per run, a proxy for third-party calls, and logs that stay clean.
- How to Inventory Non-Human Identities An NHI inventory lists every credential, owner, scope, and last use. Start with APIs that already know, then fill gaps with code scanning.
- Non-Human Identities in CI/CD: Where They Leak CI concentrates production credentials: repository secrets, deploy keys, cloud keys, and tokens in logs. Most leaks happen in the pipeline, not the app.
- The Non-Human Identity Lifecycle Request, issue, use, rotate, review, revoke. Most organisations have the first two stages and skip the rest, which is why credentials accumulate.
- Service Account vs API Key: Which Should You Use? A service account is an identity with permissions; an API key is a bearer credential. Confusing the two leads to keys with more access than needed.
- What Are the Types of Non-Human Identities? Service accounts, API keys, OAuth clients, certificates, workload identities, and agent tokens differ in lifetime and in the control that matters.
- What Is a Secrets Manager (and Do You Need One)? A secrets manager stores, controls, audits, and can issue short-lived credentials. It earns its cost once several services or people need a secret.
- What Is a Stale Non-Human Identity? A stale NHI is a credential nobody uses but that still authenticates. It is a standing backdoor with no owner and no expiry.
- What Is Workload Identity? Workload identity gives a process a short-lived credential based on what it is, not a static secret it carries. It removes the key from the deploy path.
- Deploying AI-Generated Apps to Production: A Vibecoder's Checklist Your AI wrote the app. Now here's every step between 'it works on my machine' and 'it's running in production.' Deployment, monitoring, secrets, databases, and the checklist your AI didn't include.
- The 15 Security Failures Your AI Coding Assistant Ships by Default AI coding assistants default to SQL injection, hardcoded secrets, missing access controls, and 12 other security failures. Here's every one, with the fix and the linked guide.
- InfoSec for Vibecoders: Every Security Concept Your AI-Generated Code Gets Wrong Your AI coding assistant ships SQL injection, exposed secrets, and broken access control by default. Learn every infosec concept you need to catch these before they hit production. 40+ linked guides.
- How to Find and Remove Secrets From Git History Deleting a secret from your code doesn't remove it from git history. Find leaked keys with gitleaks, scrub history, and rotate what leaked.
- Why Do .env Files Keep Leaking Secrets? .env files leak because they're easy to commit by mistake and AI assistants have no convention against it. Learn the failure and how to stop it.
- Why Your Frontend API Keys Are Not Secret Any key shipped in frontend JavaScript can be extracted by anyone. Learn what frontend keys can and can't protect, and how to gate access properly.
- How to Manage Secrets and Environment Variables Properly Store secrets outside your code: environment variables for config, a secret manager for sensitive values, and never commit .env files. A practical guide.
- How to Scan Your Codebase for Hardcoded Secrets Find API keys and tokens committed to your repo with secret scanners like Gitleaks and TruffleHog, and stop new leaks in CI. A practical tutorial.
- Are Kubernetes Secrets Actually Secret? A Kubernetes Secret is base64-encoded, not encrypted, and readable by anyone with get on Secrets. Learn what it does and does not protect, and how to harden it.
- How to Automate API Key Rotation Automate API key rotation so leaked credentials stop working quickly. A practical guide: inventory, short lifetimes, and a rotation job.