GitGuardian CEO on what to tell a CEO about leaked credentials
Fourrier says deleting a leaked commit does not revoke the key, and leaders should measure time to revocation.
Stories per day · 30 days
2 RSS
Relatedai-agents1ci-cd1credentials1deployment1disclosure1endpoints1funding1gitguardian1infisical1leaked-credentials1mcp1open-source1patch-management1series-b1supply-chain1
19 stories, newest first · one card per story
Stories tagged #secrets-management
Infisical valued at $600 million after $40 million raise
The San Francisco secrets firm says more than 1,300 organizations use it, bringing total funding to nearly $60 million.
Miren maps a week of incidents to three system-design risks
The deployment vendor cites Railway, Zeabur, PHP, GitLab, Node.js, LiteLLM and OVH while promoting its open-source control plane.
1
Essay says credential risk spans code, endpoints, vaults and AI
It argues one exposed secret can recur across laptops, pipelines, chat, Git history, and agent context.
1
12 Best Secrets Management Tools Compared (2026): Features & Pricing
A 2026 roundup compares 12 secrets-management tools, ranking HashiCorp Vault, cloud vaults, Akeyless, and ephemeral-access brokers.
4
Keyorix: Open-source secrets management for teams that can’t use SaaS
Keyorix launched a free, open-source, self-hosted secrets manager for teams unable to use SaaS, with AES-256-GCM encryption and RBAC.
4
API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary
Researchers show LLM agents can expose API secrets and evaluate a vault that keeps credentials outside the model.
Top 10 Best Secrets Management Tools in 2026 [Ranked & Scored]
A 2026 industry report ranked HashiCorp Vault as the top secrets management tool, emphasizing dynamic credentials and cloud-native integrations.
4
llm-keys-ui 0.1
Simon Willison released llm-keys-ui 0.1, a plugin providing a web UI to store API keys on machines without pasting them into agent sessions.
New infosec products of the week: September 11, 2026
Weekly product roundup: Securin Platform GA, Orchid Security AI-agent identity controls, Akeyless Agentic Runtime Authority, and Scytale AI-powered TPRM.
2
Akeyless adds real-time enforcement for AI agents in production
Akeyless launches Agentic Runtime Authority, enforcing real-time intent-based access control on AI agent actions, with integrations for Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore
2
This Key Will Self-Destruct: An Open Standard for Revocable API Keys
SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.
Product showcase: Doppler secures secrets for humans, pipelines, and AI agents
Doppler's secrets management platform centralizes credentials for engineers, CI/CD pipelines, MCP servers, and AI agents with runtime injection and dynamic secrets.
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
2
TruffleHog AWS Analyze reduces remediation time on leaked AWS credentials
Truffle Security launched TruffleHog AWS Analyze, which maps leaked AWS keys' permissions and role assumptions; research found 88% of 64,024 leaked keys still active.
2
Researchers Uncover Thousands of Leaked AWS Keys
Truffle Security researchers discovered more than 9,000 publicly accessible and active AWS key pairs, creating credential exposure and account-takeover risks.
GitLab 19.3 helps enterprises scale agentic development securely
GitLab 19.3 runs its Duo Agent Platform AI Gateway inside Dedicated single-tenant environments and adds Secrets Manager plus agentic SAST remediation.
4
How MCP Servers Can Expose Enterprise Secrets
MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.
10
Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
Wiz highlights personal developer repositories as a supply chain blind spot leaking corporate secrets, offering correlation-based risk validation and remediation.