Amazon Q Developer's VS Code extension automatically executed MCP server configurations from workspace files without user consent, exposing AWS credentials. Wiz Research disclosed CVE-2026-12957 (CVSS…
AI coding assistants are increasingly exposing credentials in git history, leading to automated credential harvesting and financial losses. A developer lost $12,000 after an AI agent hardcoded an API …
GitGuardian has introduced an MCP server that integrates directly into AI coding agents like GitHub Copilot to enforce real-time security checks on generated code. The tool addresses the challenge of …
Identiverse 2026 in Las Vegas focused on identity security for AI agents, with over 3,800 attendees and 250 speakers. Ping Identity CEO Andre Durand highlighted a shift toward 'actions, not access,' w…
A developer created leak_probe.py, an 80-line Python tool that checks which secrets actually ship in an npm package versus those found in the git repository. Testing showed 6 secret hits in the repo b…
Postman launched Passport, a secure API access system that replaces real API keys with cryptographic credential references bound to the holder, to prevent secret sprawl and leakage in the age of AI ag…
Anthropic made Workload Identity Federation (WIF) generally available on the Claude Platform as of June 17, allowing workloads to authenticate with short-lived OIDC tokens instead of static API keys. …
A developer who has run both approaches in production environments from a 5-person startup to a 200-developer platform org compares AI-based secret scanning with traditional regex-based tools in CI pi…
Attackers are increasingly targeting developer endpoints to steal credentials, as demonstrated by supply chain attacks like Megalodon, TrapDoor, and Miasma. GitGuardian's new Developer Endpoint Protec…
Leakproof, a local-first secret-egress firewall for AI coding assistants like Claude Code and Cursor, launched on Hacker News. The tool intercepts outbound requests to redact or block secrets before t…
This article explains the security risks of accidentally committing API keys and secrets to Git repositories, noting that over 10 million secrets were detected in public commits in 2023. It provides a…
Supply chain attacks on npm and GitHub Actions are exploiting the gap between malicious package publication and CVE issuance, with attackers publishing compromised versions that are installed by thous…
A security researcher discovered that the U.S. Cybersecurity & Infrastructure Agency (CISA) had exposed a large cache of plaintext passwords, SSH private keys, and other sensitive credentials in a pub…
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) publicly exposed highly sensitive credentials on a GitHub repository, including keys to AWS GovCloud accounts and plaintext p…