Practical security insights and product updates from the team building safer, simpler key management for modern APIs.
MCP skill marketplaces have the same supply chain problems as npm, except the blast radius is your AI agent's full context window. Here are 5 vulnerabilities with code fixes you can deploy today.
Read →
Your secrets management provider can read your plaintext API keys. Here's how zero-knowledge encryption works, what it changes for compliance, and when enterprise teams actually need it.
Read →
API keys shared through Slack, email, and spreadsheets waste developer hours and create security gaps. Here's what insecure credential sharing actually costs your team, and how to fix it with automated, encrypted sharing.
Read →
Stop hardcoding API keys into MCP servers. Here's the register→scope→issue→validate→expire pattern with real endpoints platform engineers can deploy today.
Most teams can't answer a basic question: if this API key leaks, how much damage can it do? We built a blast radius report to find out. The answer was worse than expected.
Rotating API keys every 90 days sounds responsible. Attackers exploit leaked keys in minutes. Here's why rotation is a lagging control and what actually stops credential-based breaches.
AI plugins inherit every credential in your .env file. Audit what your ChatGPT plugin can actually reach and scope credentials so a compromised plugin stays contained.
AI coding tools like Cursor and Copilot transmit open .env files as context. Here's the real .env exposure risk and the architectural fix that removes it entirely.
MCP servers that hold long-lived API keys are the new .env file problem. Here's how session-scoped credential brokering limits blast radius when things go wrong.
Environment variables work fine solo. They fail in production. The Phantom Token Pattern gives agents fake tokens that proxy to real credentials at runtime.
MCP is being rushed into production with no real auth story. The security community is sounding the alarm. Here's what the credential gap looks like - and how to close it before your org gets burned.
Zero trust says never trust, always verify, least privilege. Most AI agent deployments violate all three. Here's how a credential proxy closes the gap without rewriting your stack.
Every API key you give an AI agent is an attack surface. A local reverse proxy keeps your credentials safe while agents get full API access.