Five steps to review the credentials behind your apps, tools, and AI agents.
October’s security incidents carried real consequences: more than $6 billion in cryptocurrency stolen in one attack, and at least nine AI developer platforms disclosing incidents during the month.
These were separate incidents with different attack paths. For developer teams, they raise a practical question: if a credential leaked today, would you know where it’s used, what it can access, and how to replace it?
Pick one project and work through this checklist with your team. It focuses on credentials and access, one part of securing your development workflow.
You can’t address a leaked credential if you don’t know it exists or which systems depend on it.
Scan the current repository and its history for secrets using a secret-scanning tool. Review findings and revoke or rotate exposed credentials.
Review .env files, shell profiles, CI settings, and deployment configuration. Remove credentials the project no longer needs.
Assign an owner to every active credential and identify its consumers so replacements can reach each dependent system.
Keep secret values out of your inventory. Record names, owners, and storage locations instead.
How 1Password can help: 1Password Developer Watchtower can help discover local .env files containing plaintext secrets so you can import them into Environments. Use a separate secret-scanning tool for repository history, and revoke or rotate credentials that may have been exposed.
Every copy is another place to protect and update.
Replace plaintext credentials in project configuration with secret references or runtime delivery.
Run the application with the replacement setup and verify the workflows that use those credentials.
Remove obsolete plaintext copies. If a value was exposed, confirm the old credential has been revoked.
How 1Password can help: 1Password CLI supplies secrets as environment variables at runtime, and 1Password SDKs provide programmatic access. These reduce hardcoded copies; the receiving application still has access to the real values.
Review both which secrets a workflow can retrieve and what those secrets allow it to do.
Replace production credentials used in development with separate credentials scoped to development.
Replace personal credentials used by automated jobs with a dedicated automation identity.
Remove permissions each workflow doesn’t need and verify it still works. Configure usage alerts and spending limits where supported.
How 1Password can help: 1Password Service Accounts give automation an identity separate from an individual, with controls over accessible vaults, Environments, and actions. Permissions and spending limits for the retrieved API keys must be configured with their issuing providers.
An agent’s access includes its connected tools and authenticated sessions.
Replace secrets pasted into prompts or hardcoded in MCP configuration with an appropriate credential integration. Rotate values that may have been exposed.
Remove tools, credentials, and account permissions the agent doesn’t need for its task.
Enable approval for consequential actions where supported, and test how to stop the agent and revoke its access.
How 1Password can help: Environments and CLI can supply credentials to locally launched MCP servers without hardcoding them in configuration; the server still receives the real secrets. For supported personal-agent website sign-ins, 1Password for Agents fills approved Login credentials outside the agent’s view.
Secure AI access guide · Supported personal-agent sign-ins Keeping a password outside an agent’s view doesn’t limit what it can do after signing in. Review the permissions of the account it uses.
Practice with a nonproduction credential before you need to replace one during an incident.
Replace a nonproduction credential and update every application or job that uses it.
Restart or redeploy affected processes, verify the replacement works, and confirm the revoked credential fails.
Review provider logs for unexpected activity and document any missed dependencies before repeating the process elsewhere.
How 1Password can help: Update replacement values in Environments or vault items so workflows can retrieve them on their next read or launch. Revoke the old credentials with their issuing providers and reload any processes still holding the previous values.
If compromise is suspected, prioritize containment rather than delaying revocation for a convenient migration. Existing sessions may require separate termination. Assign owners and target dates to the actions above. Start with one project, fix the gaps you find, and use what you learn for the next review.
For setup instructions, our developer quickstart covers the CLI, project secrets, and SSH authentication.