Secrets learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Terraform Secrets Management Best Practices
   9 min readblog.gitguardian.com2026
   Library for managing secrets within Terraform configurations. It highlights best practices such as avoiding hard-coded secrets, leveraging secrets managers like AWS Secrets Manager, and utilizing the `sensitive` flag for outputs. The library also details how Terraform states and plans can expose sensitive data and introduces ephemeral resources as a mechanism to fetch secrets without persisting them in the state file.
2. 8 Best Secret Scanning Tools (2026)
   10 min readappsecsanta.com2026
   Library for detecting hardcoded credentials, API keys, and tokens. It highlights tools like Gitleaks for pre-commit blocking, TruffleHog for live credential verification, and detect-secrets for legacy codebases. GitGuardian is noted as a leading managed platform, offering real-time monitoring and collaboration tool scanning. The library emphasizes the importance of early detection to prevent data breaches and account takeovers, contrasting the cost of pre-commit remediation with post-commit incident response.
3. AWS Secrets Engine | HashiCorp Vault
   15 min readdeveloper.hashicorp.com2026
   Library for dynamically generating AWS credentials. This secrets engine creates IAM users, assumes roles, or generates federation and session tokens based on defined Vault roles. It supports creating short-lived, time-bound credentials automatically revoked upon lease expiration, offering an alternative to static IAM user management. Configuration involves enabling the engine, setting root AWS credentials for Vault's communication, and defining Vault roles that map to AWS IAM policies and credential types.
4. Show HN: Laptop is the last place your secrets are still in plaintext
   13 min readgithub.com2026
   Tool for managing local secrets on macOS Apple Silicon, `jit` encrypts plaintext secrets like `.env` files and AWS credentials into a local vault secured by Touch ID. It then rewrites configuration files to present decoys on disk, injecting real secrets into memory only for authorized processes, preventing exposure from accidental `curl | sh` commands or compromised AI agents. `jit` supports various injection mechanisms including environment variables, credential helpers for tools like AWS and Docker, and named-pipe mounts for file-based readers.
5. Your AI Agents Are Using Your Credentials
   9 min readblog.gitguardian.com2026
   Library for discovering and mitigating secrets exposed by AI agents. This resource highlights that AI agents often use credentials issued to humans or workloads, bypassing enterprise identity controls and creating governance blind spots. It advocates for finding agent credential locations, identifying owners, and implementing prevention measures like blocking new secret exposure while migrating existing credentials. The ultimate goal is scoped, short-lived access using agent-specific or delegated identities to limit the impact of stolen credentials. The library addresses issues seen with tools like Claude Code, GitGuardian, and Nx s1ngularity, emphasizing that agent identity is fundamentally a secrets problem.

Real testing methodology, tooling, and writeups that show the work.

1. AI Is the Newest Developer To Misunderstand Secrets In Your Git History
   7 min readblog.gitguardian.com2026
   Library for securing Git repositories, teaching AI coding agents like Cursor, Claude Code, and Codex how to properly handle secrets and avoid leaking them into commit history. It emphasizes rotating credentials first and using tools like `git-filter-repo` for thorough history cleanup. The library integrates with AI assistants through Agent Skills and AI hooks, enabling pre-commit scanning and real-time checks on prompts, commands, and outputs, preventing secrets from entering the repository in the first place.
2. Pre-Commit Hooks for Secret Detection: Setup in 10 Minutes
   7 min readrafter.so2026
   Library for implementing pre-commit hooks to prevent secrets from entering Git history. It details the setup process for tools like gitleaks, detect-secrets, and TruffleHog, offering solutions for immediate detection and blocking of credential leaks. The library emphasizes catching secrets at the cheapest point in the lifecycle, preventing the need for costly history rewrites and incident response by integrating these tools seamlessly into the Git commit workflow.
3. Integrating HashiCorp Vault with Kubernetes for Secrets Mgmt
   8 min readdev.to2026
   Library for integrating HashiCorp Vault with Kubernetes for secure secrets management. This resource details deploying Vault using Helm in a Kubernetes cluster, enabling the Kubernetes authentication method, and configuring Vault to communicate with the Kubernetes API. It covers creating roles that map Kubernetes service accounts to Vault policies, enabling the Key/Value (kv) secrets engine, and storing secrets like database passwords. The integration leverages Vault's encryption at rest, dynamic secrets generation, and fine-grained access control to overcome limitations of native Kubernetes secrets.
4. Securing Kubernetes Secrets with HashiCorp Vault (InfraCloud)
   13 min readinfracloud.io2026
   Library for securing Kubernetes secrets with HashiCorp Vault, this resource details how to configure Vault for high availability and implement automatic unsealing using Azure Key Vault. It covers creating Azure services like Key Vault and App Registration, then demonstrates deploying Vault with its Helm chart, specifying Azure Key Vault integration for unsealing and Raft for storage. The setup aims to overcome the limitations of Kubernetes native secrets by providing a centralized and robust secret management system.
5. Manage Kubernetes native secrets with Vault Secrets Operator
   12 min readdeveloper.hashicorp.com2026
   Library for managing Kubernetes native secrets with HashiCorp Vault. The Vault Secrets Operator (VSO) acts as a Kubernetes operator, syncing secrets between Vault and Kubernetes native secrets in specified namespaces. It supports kv-v1 and kv-v2, TLS certificates via PKI, and static and dynamic secrets. The tutorial demonstrates installation of Vault and VSO using Helm on minikube, configuring Kubernetes authentication, KV secrets engine, and a role for accessing a static secret.

Novel research, edge cases, and the techniques that push the class forward.

1. Machine-Speed Credential Abuse: What the ChainDrop npm Worm Changes
   9 min readblog.gitguardian.com2026
   Library for detecting exposed credentials across the SDLC; prioritizes remediation by validity and severity, and uses AI hooks to prevent agents from accessing secrets, addressing the machine-speed credential abuse exemplified by the ChainDrop npm worm. This worm, part of the Shai-Hulud attack, compromised 444 npm packages and leveraged malicious hooks in Claude Code and VS Code to trigger execution at machine speed, collapsing the time between credential discovery and abuse to near-zero, effectively removing human reaction windows.
2. Securing Agentic AI Workflows in n8n: From Leaked API Keys to Encryption Key Compromise
   13 min readblog.gitguardian.com2026
   Analysis of n8n agentic workflows reveals a critical risk centered on the `N8N_ENCRYPTION_KEY`. Research uncovered three weaknesses in key derivation and session authentication, allowing for JWT secret entropy reduction and session forgery for OIDC or pending users. Offline recovery of weak `N8N_ENCRYPTION_KEY` values from public artifacts like leaked JWTs and instance IDs was demonstrated, affecting 13.8% of scanned instances. Furthermore, leaked API keys, particularly those with administrator privileges, provide a direct attack vector. CVE-2026-25053 showcases how workflow access, via the Git node vulnerability, can escalate to arbitrary file reads, potentially exposing the `N8N_ENCRYPTION_KEY` and stored credentials.
3. Multiple Chinese civic apps share one reward/lottery backend whose signing secret is recoverable
   14 min readneurowinter.com2026
   Library that identifies vulnerabilities in shared civic reward backends used by multiple Chinese government applications. The analysis reveals that these multi-tenant SaaS platforms, including tmuyun and aihoge, often use public signing salts and serve HMAC keys on request, making reward campaigns forgeable. This allows for the manipulation of points and lottery payouts, potentially impacting citizen PII and public trust. The study highlights how attackers can exploit these shared signing schemes across numerous applications by targeting the SaaS providers directly.
4. depthfirst | 1-Click RCE To Steal Your Moltbot Data and Keys
   5 min readdepthfirst.com2026
   Analysis of CVE-2026-25253 in OpenClaw details a 1-click RCE exploit achieved by chaining a logic flaw in gateway URL ingestion with Cross-Site WebSocket Hijacking (CSWSH). The vulnerability allows an attacker to steal authentication tokens, bypass localhost restrictions, disable security features like user confirmations and sandboxing via API calls, and execute arbitrary commands on the victim's machine.
5. Snipping the Long Tail of Shai-Hulud 2.0
   6 min readwiz.io2026
   Analysis of the Shai-Hulud 2.0 worm reveals its persistence through mechanisms like private registries, cached packages, and a lingering OpenVSX IDE extension (asyncapi-preview v1.0.1). This "long tail" of infections impacted over ⅓ of the Fortune 100, with leaked credentials remaining valid, potentially linking to the Trust Wallet $7M exploit due to shared exfiltrated GitHub and Web Store credentials, and similar naming conventions. Wiz Research "snipped the tail" by coordinating a clean OpenVSX extension update.