An autonomous AI coding agent hardcoded a production API credential into a new app.config file and merged it to the main branch, triggering a five-figure surge in OpenAI API charges within forty minut…
An enterprise platform engineering approach proposes a four-stage DevSecOps CI/CD pipeline for autonomous AI agents, combining secret scanning, AI-augmented code review, prompt security analysis, and …
An autonomous penetration-testing agent called Strix discovered a live GitHub personal access token with admin rights to Baseten's product repositories, GitOps deployment repo, and private customer co…
A developer has built SecretLoop, a secret scanner now in Preview on Open VSX that goes beyond detection to verify whether exposed credentials are still live and guide remediation. The tool integrates…
An engineer's comparison of secret detection tools Gitleaks, TruffleHog, and GitHub Secret Scanning reveals that most CI scanners suffer from alert fatigue due to regex-based false positives. The anal…
A developer has detailed an open-source, cloud-agnostic continuous threat exposure management (CTEM) program that mirrors an attacker's reconnaissance to identify and remediate exposures before they b…
Truffle Security CEO Dylan Ayrey and Socket CEO Feross Aboukhadijeh said AI models are already capable of executing sophisticated cyberattacks, including SQL injection and supply chain attacks, and th…
Truffle Security scanned all 7.6 petabytes of Hugging Face's public datasets and verified 221,303 working credentials, including 11,496 live AI provider keys and 8,557 GCP service-account keys. The sc…
Truffle Security's scan of 7.6 petabytes of public Hugging Face data found 221,303 live, unique credentials across 6,003 datasets, including 8,557 Google service-account keys, 8,594 database logins, 3…
A security scan of 7.6 petabytes of public Hugging Face training data across 187 million files uncovered 221,303 live, unique credentials in 6,003 datasets, including 349 GitHub personal access tokens…
A developer built Wardrail, an open-source scanner that checks for API-key leaks and security risks in vibe-coded projects. The tool scans Git history, MCP configuration, and Agent instruction files f…
A developer found that AI coding assistants like Cursor, Copilot, Lovable, and Bolt generate code with security flaws such as hardcoded API keys, permissive CORS settings, and missing input validation…
A security audit of a client's GitHub Actions workflows uncovered three live LLM API keys, including one in a committed `.env.staging` file, that had been leaking in plaintext through CI/CD pipelines.…