How AI Coding Agents Can Silently Expose Your API Keys and Secrets

·1 views

AI coding agents like Claude Code access source files, config files, and environment variables, then relay summaries of that content to third-party APIs, creating serious secret-exposure risks. Three main leak vectors exist: context exfiltration, where the agent reads .env files and includes values in prompts; tool output echo, where secrets appear in captured stdout; and prompt injection, where malicious instructions trick the agent into sending credentials externally. Common mitigations such as secret managers and .env hiding tools still leave credentials vulnerable once a command runs. A developer has released an open-source CLI tool called 'trustless' that addresses this by injecting credentials at the process and transport layer rather than exposing them to the agent's context window. The core principle is that agents should receive capabilities, not credentials, and all outbound requests should be scanned to confirm no secrets have leaked.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Goish ports Go 1.25 runtime into no_std Rust, targeting compliance and provenance

Thai engineer Chanwit Kaewkasi from Korat, working under Cogentica AI, has built Goish — a project that ports Go 1.25's standard library and runtime into Rust without relying on std, glibc, Tokio, or a garbage collector. The project brings Go's concurrency primitives — goroutines, channels, and select — into Rust while preserving memory safety, producing fully static binaries. A key motivation behind Goish is software supply-chain compliance: each ported function carries a comment tracing it back to the exact file and line in the Go SDK, with CI checks verifying those references remain accurate. This function-level provenance addresses a gap that tools like SLSA and SBOM cannot fill — proving that ported crypto or runtime code faithfully reflects its upstream source rather than being reimplemented loosely. The project is timed against approaching regulatory deadlines, including the EU Cyber Resilience Act's SBOM mandates and the US CNSA 2.0 transition, which together demand traceable, verifiable code lineage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How EU Startups Should Actually Compare Speech-to-Text APIs for Invoice Processing

A technical guide argues that EU startups should evaluate speech-to-text APIs based on cost per accepted invoice rather than advertised per-minute pricing. The approach involves routing providers like OpenAI, Deepgram, AssemblyAI, and Google Cloud through a common interface and testing them against real supplier audio recordings. A small corpus of around 20 carefully chosen clips — covering invoice numbers, VAT identifiers, dates, and currency codes — is recommended to expose meaningful accuracy failures. EU data-handling compliance is treated as a hard disqualifier rather than a soft scoring factor. The framework emphasizes that a cheap transcript which corrupts a VAT number or total has no practical value, making accuracy-adjusted cost the only meaningful metric.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Use Feature Flags API With React Polling for Support Console UI

A technical guide outlines how to integrate a feature flags API as a polled configuration source in a React-based customer support console. The approach recommends loading default flag values synchronously before any network request, so the UI renders immediately and remains stable even if the configuration fetch fails or times out. Flags should only control presentation elements like labels, layouts, and diagnostic panels — never server-side decisions such as notification retries, billing, or user authorization. The React state machine should use a single shared context to avoid multiple competing pollers, and retain the last valid configuration during refresh cycles to prevent visual disruption. The guide also cautions that polling alone does not provide audit history, evaluation statistics, or real-time monitoring, and that separate tooling is needed for those requirements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How EU Startups Should Evaluate Speech-to-Text APIs Beyond Advertised Pricing

Choosing a speech-to-text API for an EU startup in 2026 requires evaluating more than the advertised per-minute rate, as billing minimums, language accuracy, latency, and data compliance all affect real costs. Vendors may round short audio clips to larger billing units, meaning actual invoices can far exceed estimates based on average recording length. Quality testing should use real support audio containing product names, error codes, and varied accents rather than generic benchmarks, since transcription errors can corrupt downstream workflows. Asynchronous processing and webhook-based completion are recommended for uploaded call queues to avoid holding open connections. Candidates such as OpenAI, Deepgram, AssemblyAI, and Google Cloud should each be verified for EU data residency, retention policies, and subcontractor disclosures before price comparisons are made.

0 comments Read more at DEV Community