Insights, tutorials, and best practices for secure development
Code quality tools enforce style and catch bugs, but they miss security vulnerabilities. Learn where quality tools fall short and how to close the gap.
Compare secret scanning tools — Gitleaks, TruffleHog, detect-secrets, and git-secrets — for finding leaked API keys: detection methods, speed, and pre-commit fit.
An application security solution should catch vulnerabilities in code, dependencies, and secrets without slowing you down. Rafter delivers all three.
Best vulnerability scanner tools catch security flaws before production. Learn what separates good scanners from great ones and how to pick the right fit.
Pre-commit hooks catch leaked API keys before they enter git history. Step-by-step setup for betterleaks, detect-secrets, and TruffleHog with real config examples.
An OpenAI key (sk- or sk-proj-) exposed in a .env file is compromised in minutes. Here's the 15-minute response, the real cost, and how to prevent the next leak.
Leaked API keys get exploited within minutes. Step-by-step emergency response to revoke, rotate, audit, and prevent future credential leaks.
GitHub secret scanning detects 200+ token formats automatically. But it misses custom secrets, env files, and git history. Here is what it covers and where gaps remain.
Leaked API keys caused $4.2B in cloud breaches last year. Learn how to detect, prevent, and respond to credential leaks across your entire development lifecycle.
MCP ships with minimal security defaults. This checklist operationalizes defense across seven control domains—trust tiers, localhost hardening, output sanitization, rate limiting, audit logging, multi-tenant isolation, and incident response—with concrete implementation examples and verification tests.
MCP's security lives entirely in the application layer—no injection detection, no audit trail, no behavioral monitoring, no per-tool access scoping. This post defines what a production security layer must provide, how to architect it across five components, and three deployment patterns with tradeoffs.
MCP audit logging is optional and inconsistent, so agent tool calls often go untraced. See the SOC 2, HIPAA, and PCI-DSS compliance risk, and the fix.
Showing 133–144 of 211 posts