Insights, tutorials, and best practices for secure development
A .env file with a real API key hitting a public repo, Docker image, or build log means the key is compromised in minutes — this guide decodes sk- proj-, sk-or-v1, sk_live, ghp_, and AKIA prefixes and covers detection and prevention (rotation runbook linked separately).
A credential stealer hid a prompt injection telling AI scanners the package is clean. The flip side worries me more: malware that makes the AI look away.
Rafter is now installable from the GitHub Marketplace. Add the Action to your workflow and Rafter scans the repo in CI on every push — dependency and supply-chain findings, secrets, and a security score, at the exact moment a vibe-coded prototype becomes real code that needs scanning.
Stripe API key security and best practices 2026: key types, sk_live_ vs sk_test_, restricted keys, rotation, and catching leaks before attackers do.
TrapDoor hid invisible instructions in CLAUDE.md and .cursorrules so coding agents could be tricked into running a fake security scan and exfiltrating developer secrets. The agent-instruction file is now part of your attack surface. Here's the attack and the defense.
Gitleaks vs TruffleHog for 2026 — detection method, speed, pre-commit and CI fit, false positives, and which secret scanner to choose for your team.
Semgrep vs SonarQube compared on custom rules, taint analysis for injection, language coverage, CI/CD fit, and pricing — with a clear pick by team profile.
TrapDoor, a disclosed prompt-injection class, and the MCP RCE flaw are the same incident in three costumes: untrusted input reaching a trusted execution path through the AI coding agent. Here's why the agent is now your supply chain, and how to scan it.
How vibe-coded apps fail at error handling — and the exact prompts to fix unhandled exceptions, null derefs, and resource leaks in AI-generated code.
On April 29, 2026, Instructure detected unauthorized activity in Canvas. By May 7, the same actor had defaced login pages at multiple institutions. ShinyHunters claims data on 275 million users across 8,809 institutions and has set May 12 as a leak deadline. The data scope is narrow — names, emails, student IDs, Canvas messages — and that is precisely what makes the second-order phishing wave dangerous.
Zach Rice — the creator of Gitleaks — shipped a new scanner called Betterleaks. It uses byte-pair encoding token efficiency instead of Shannon entropy and lifts recall from 70.4% to 98.6% on the CredData benchmark. Here's what that actually means.
On April 30, 2026, two malicious versions of the PyPI package lightning — 2.6.2 and 2.6.3 — were published with credential-stealing code that activates on import. The package backs PyTorch Lightning, a 31,000-star AI-training library. The detail worth stopping on: every poisoned commit the worm pushes to victim repositories is authored under a hardcoded identity designed to impersonate Anthropic's Claude Code.
Showing 13–24 of 213 posts