GitGuardian finds thousands of valid API keys exposed in public GitHub config files

·1 views

In 2025, GitGuardian discovered 24,008 unique secrets in public MCP configuration files on GitHub, with 2,117 being valid credentials. These credentials were not leaked via an exploit but were mistakenly placed into public repository configs, a practice often suggested in setup guides. The article details how secrets can leak through prompts, tool responses, logs, and agent memory, making them accessible to the AI model. It recommends storing credentials in an encrypted vault that the model cannot query, using a trusted proxy layer to attach them to requests. This method ensures the AI agent never directly handles or sees the raw API tokens.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Small feedback loops enable faster, lighter product decisions

Product teams can avoid heavy, research-dependent decision-making by adopting small weekly feedback loops. The method involves weekly identification of a key uncertainty and running a minimal test to address it. Teams then compare their expectations with the actual observations and log the resulting decision and next steps. This documented, shared log makes learning visible quickly, allowing the team to adapt plans based on evidence. The goal is not perfect prediction but enabling timely changes to product direction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Independent benchmark tests six coding agents across seven local AI models

A developer conducted an extensive benchmark test evaluating six AI coding agents across seven locally-run models. Each agent was run thirty times per model, with performance measured by task completion rates. The test revealed significant performance differences among agents, particularly when models generated tool calls in non-standard formats. The full methodology, raw results, and analysis are publicly available on GitHub. The developer disclosed they created one of the tested agents, Polyglot, and made all data public for transparency.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vercel simplifies deploying web projects from code to custom domain in four steps.

The article details a four-step process for deploying a website from local code to a live custom domain using Vercel. It involves connecting a GitHub repository to Vercel for automated continuous deployment upon each code commit. Users then configure their custom domain by adding required DNS records provided by Vercel to their domain registrar's settings. This method aims to streamline the process, handling infrastructure like SSL certificates and global distribution automatically.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide demonstrates creating a simple TCP client using Python's built-in socket library.

A DEV Community article provides a tutorial for writing a basic TCP client in Python. The guide uses only the standard library's socket module to connect to a server and exchange data. It demonstrates connecting to a web server, sending an HTTP GET request, and printing the response. The code makes simplified assumptions for brevity, such as always successful connections and immediate server responses. The author notes this approach is common for quick utility scripts, like those used in security reconnaissance.

0 comments Read more at DEV Community