{"slug": "a-practical-security-guide-for-developers", "title": "A practical security guide for developers", "summary": "1Password published a five-step security checklist for developer teams to audit the credentials behind their apps, tools and AI agents, citing October incidents in which more than $6 billion in cryptocurrency was stolen in a single attack and at least nine AI developer platforms disclosed incidents during the month. The guide directs teams to scan repositories and history for secrets, replace plaintext credentials with secret references or runtime delivery, scope development and automation credentials separately from production and personal ones, and strip unneeded tools and permissions from AI agents. 1Password positions its Developer Watchtower, CLI, SDKs, Service Accounts and 1Password for Agents as tools for each step, while noting that permissions and spending limits for retrieved API keys must be configured with the issuing providers.", "body_md": "Five steps to review the credentials behind your apps, tools, and AI agents.\n\n[__October’s security incidents__](https://1password.com/blog/october-security-incidents-exposed-credentials) carried real consequences: more than [__$6 billion__](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) in cryptocurrency stolen in one attack, and at least [__nine AI developer platforms__](https://www.wiz.io/blog/black-october-for-ai-developer-platforms) disclosing incidents during the month.\n\nThese were separate incidents with different attack paths. For developer teams, they raise a practical question: if a credential leaked today, would you know where it’s used, what it can access, and how to replace it?\n\nPick one project and work through this checklist with your team. It focuses on credentials and access, one part of securing your development workflow.\n\nYou can’t address a leaked credential if you don’t know it exists or which systems depend on it.\n\nScan the current repository and its history for secrets using a secret-scanning tool. Review findings and revoke or rotate exposed credentials.\n\nReview .env files, shell profiles, CI settings, and deployment configuration. Remove credentials the project no longer needs.\n\nAssign an owner to every active credential and identify its consumers so replacements can reach each dependent system.\n\nKeep secret values out of your inventory. Record names, owners, and storage locations instead.\n\nHow 1Password can help: 1Password Developer Watchtower can help discover local .env files containing plaintext secrets so you can import them into Environments. Use a separate secret-scanning tool for repository history, and revoke or rotate credentials that may have been exposed.\n\nEvery copy is another place to protect and update.\n\nReplace plaintext credentials in project configuration with secret references or runtime delivery.\n\nRun the application with the replacement setup and verify the workflows that use those credentials.\n\nRemove obsolete plaintext copies. If a value was exposed, confirm the old credential has been revoked.\n\nHow 1Password can help: 1Password CLI supplies secrets as environment variables at runtime, and 1Password SDKs provide programmatic access. These reduce hardcoded copies; the receiving application still has access to the real values.\n\nReview both which secrets a workflow can retrieve and what those secrets allow it to do.\n\nReplace production credentials used in development with separate credentials scoped to development.\n\nReplace personal credentials used by automated jobs with a dedicated automation identity.\n\nRemove permissions each workflow doesn’t need and verify it still works. Configure usage alerts and spending limits where supported.\n\nHow 1Password can help: 1Password Service Accounts give automation an identity separate from an individual, with controls over accessible vaults, Environments, and actions. Permissions and spending limits for the retrieved API keys must be configured with their issuing providers.\n\nAn agent’s access includes its connected tools and authenticated sessions.\n\nReplace secrets pasted into prompts or hardcoded in MCP configuration with an appropriate credential integration. Rotate values that may have been exposed.\n\nRemove tools, credentials, and account permissions the agent doesn’t need for its task.\n\nEnable approval for consequential actions where supported, and test how to stop the agent and revoke its access.\n\nHow 1Password can help: Environments and CLI can supply credentials to locally launched MCP servers without hardcoding them in configuration; the server still receives the real secrets. For supported personal-agent website sign-ins, 1Password for Agents fills approved Login credentials outside the agent’s view.\n\n[__Secure AI access guide__](https://www.1password.dev/get-started/secure-ai-access) · __Supported personal-agent sign-ins__\n\nKeeping a password outside an agent’s view doesn’t limit what it can do after signing in. Review the permissions of the account it uses.\n\nPractice with a nonproduction credential before you need to replace one during an incident.\n\nReplace a nonproduction credential and update every application or job that uses it.\n\nRestart or redeploy affected processes, verify the replacement works, and confirm the revoked credential fails.\n\nReview provider logs for unexpected activity and document any missed dependencies before repeating the process elsewhere.\n\nHow 1Password can help: Update replacement values in Environments or vault items so workflows can retrieve them on their next read or launch. Revoke the old credentials with their issuing providers and reload any processes still holding the previous values.\n\nIf compromise is suspected, prioritize containment rather than delaying revocation for a convenient migration. Existing sessions may require separate termination.\n\nAssign owners and target dates to the actions above. Start with one project, fix the gaps you find, and use what you learn for the next review.\n\nFor setup instructions, our [__developer quickstart__](https://www.1password.dev/get-started/developer-quickstart) covers the CLI, project secrets, and SSH authentication.", "url": "https://wpnews.pro/news/a-practical-security-guide-for-developers", "canonical_source": "https://1password.com/blog/developer-guide-to-exposed-credentials", "published_at": "2026-11-05 00:00:00+00:00", "updated_at": "2026-11-05 20:23:32.332617+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "developer-tools"], "entities": ["1Password", "1Password Developer Watchtower", "1Password CLI", "1Password SDKs", "1Password Service Accounts", "1Password for Agents", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/a-practical-security-guide-for-developers", "markdown": "https://wpnews.pro/news/a-practical-security-guide-for-developers.md", "text": "https://wpnews.pro/news/a-practical-security-guide-for-developers.txt", "jsonld": "https://wpnews.pro/news/a-practical-security-guide-for-developers.jsonld"}}