Why Knowing What Credentials Were on a Compromised Laptop Is So Hard

·4 views

When a developer's laptop is stolen or compromised, security teams must quickly determine which credentials were exposed — a process experts call answering the 'blast radius question.' Most organizations lack a pre-incident credential inventory, forcing responders to reconstruct exposed secrets manually under time pressure or rotate everything indiscriminately. Credentials are scattered across .env files, shell histories, CLI caches, SSH keys, and AI tool caches, making comprehensive discovery difficult. GitGuardian's 2026 report found 28.6 million new secrets leaked on public GitHub in 2025 alone, a 34% year-over-year increase, underscoring the scale of the problem. Security experts argue that maintaining a per-machine credential inventory before an incident occurs is the key to faster, more precise response and a smaller blast radius.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build Production Observability for Google AI Agents Using OpenTelemetry

Debugging AI agent failures in production is difficult because traditional logs record what executed but not why decisions were made, leaving engineers without causal context. A structured observability approach using OpenTelemetry spans and events can reconstruct an agent's full decision path, from model calls and tool executions to policy checks and retries. During local development, visualizing runs as a tree helps expose missing steps, unexpected retries, and direction changes before issues reach production. Rather than logging raw prompts, the recommended method attaches structured reason codes at consequential decision boundaries, making agent behavior aggregable and auditable. Frameworks like Google ADK, Genkit, and Gemini can feed this telemetry pipeline into Cloud Trace, Logging, and Monitoring for alerts and dashboards.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dirty AI Context Causes Bad Code Suggestions — Here Is How to Fix It

AI coding assistants often produce incorrect suggestions not due to model weakness but because they receive cluttered, irrelevant context from large repositories. A workflow published on DEV Community proposes a context isolation layer that limits what an AI agent can see to only the files changed in a git diff, a fixed allowlist, and the latest relevant test output. The approach treats context selection as a routing problem, decided by the developer before the model processes anything, rather than relying on better prompts. The guide uses MonkeyCode's open-source project, which offers free model access and a free local server with an OpenAI-compatible endpoint, to demonstrate the pipeline. The author disclosed the article was prepared as part of MonkeyCode's product outreach, though the core principles are described as applicable to any AI coding tool.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer shares key lessons from training an AI policy on Hugging Face's SO-ARM101

A developer documented their experience building and training an Action Chunking with Transformer (ACT) policy using Hugging Face's LeRobot ecosystem and the low-cost, 3D-printed SO-ARM101 robotic arm. The project ran on a MacBook using a pyenv and miniconda3 environment, with the LeRobot package installed via PyPI. A multi-camera setup — including a wrist camera for close-up feedback and an overhead camera for global context — was recommended for better policy consistency over basic single-camera configurations. The developer advised recording datasets at lower resolutions like 640x480 rather than full 1080p to significantly reduce dataset size, speed up training, and cut memory usage. Allocating at least two encoder threads per camera during episode recording was also flagged as essential to prevent frame drops during teleoperation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Free Browser Tools That Teach SQL Without Installing Anything

Learning SQL effectively requires writing and running queries repeatedly, but the traditional setup process — installing a database — discourages many beginners before they start. A recent guide highlights three free, signup-free browser-based database terminals that let learners practice SQL directly in their browsers. The first tool, SQL Terminal Simulator, walks users through 13 structured lessons covering everything from basic SELECT statements to window functions and common table expressions using a sample commerce dataset. A second simulator focuses on psql, the command-line PostgreSQL client widely used in professional environments, teaching meta-commands that developers encounter on the job. Together, the tools are designed to build both language recall and practical client familiarity — the two skills most tested in interviews and real-world incidents.

0 comments Read more at DEV Community