The newest Secrets & Credential Leaks resources are on the Secrets & Credential Leaks page. For a reading order instead of a date order, see the Secrets & Credential Leaks learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-08 2026 | TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack news 12 min read Supply Chain | Library for analyzing the Mini Shai Hulud supply chain attack that compromised TanStack npm packages. This incident, attributed to TeamPCP, involved hijacking a legitimate release pipeline using a pull_request_target vulnerability and GitHub Actions cache poisoning to exfiltrate OIDC tokens and publish malicious packages with valid SLSA provenance. The attack chain mirrors techniques documented in prior compromises like tj-actions/changed-files and utilizes malicious JavaScript payloads within optional dependencies, executed via npm lifecycle hooks. → snyk.io |
| 2026-06-08 2026 | Fix SCA issues at scale in your terminal with Snyk Remediation Agent in the CLI intermediate 6 min read AI | Tool for addressing software composition analysis (SCA) vulnerabilities at scale, the Snyk Remediation Agent offers an experimental CLI experience. This agent leverages Snyk's security intelligence, including fix targets, breakability analysis, reachability, and package health, to guide LLMs in generating targeted fixes. Benchmarks show significant improvements in fix rates for SAST and SCA issues compared to using LLMs alone, while reducing token costs. The agent currently supports SCA and is in active development for SAST, Container, and IaC, aiming to provide intelligence-guided, developer-in-the-loop remediation directly from the terminal. → snyk.io |
| 2026-06-08 2026 | Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm news 5 min read Supply Chain | Writeup on a credential-stealing worm, "Miasma," compromising 32 official @redhat-cloud-services npm packages. This malware, a variant of the open-sourced Mini Shai-Hulud, exploited a compromised GitHub Actions OIDC pipeline, bypassing trusted publishing to inject obfuscated `index.js` payloads via preinstall scripts. It targets AWS, GCP, Azure credentials, GitHub Actions secrets, SSH keys, and other sensitive tokens, mirroring prior attacks on Mistral, TanStack, and Bitwarden. → aikido.dev |
| 2026-06-08 2026 | Top 16 Secrets Management Tools and Platforms for 2026 (Compared) beginner 19 min read | Library comparing 16 secrets management tools including CyberArk Conjur, HashiCorp Vault, Akeyless, Doppler, and 1Password Secrets Automation. It covers elements like automated secrets rotation, role-scoped access, and integrations with systems like GitHub Actions, Azure DevOps, and Kubernetes through tools like External Secrets Operator. The library highlights key considerations for choosing a tool based on cloud environment, open-source priorities, and AI agent support, noting the increasing prevalence of exposed secrets in public GitHub commits and internal repositories. → blog.gitguardian.com |
| 2026-06-08 2026 | How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework beginner 22 min read AI AuthZ | Framework for AI-powered vulnerability scanning that utilizes taskflows to identify high-impact web security vulnerabilities. This open-source tool, requiring a GitHub Copilot license, breaks down repositories into components, performs threat modeling, and then audits suggested vulnerabilities with rigorous criteria, reducing hallucinations and false positives. It has successfully reported over 80 vulnerabilities, including authorization bypasses and information disclosures, such as accessing personally identifiable information (PII) or unauthorized logins. → github.blog |
| 2026-06-08 2026 | We hardened zizmor's GitHub Actions static analyzer news 4 min read Supply Chain | Library hardening for zizmor, a static analyzer for GitHub Actions misconfigurations. This effort addressed YAML anchor support, fixing parsing bugs, surfacing deserialization edge cases, and aligning the expression evaluator with GitHub's Known Answer Tests. The work was validated against a corpus of 41,253 workflows from 6,612 repositories, leading to significant improvements in zizmor's robustness and the ability to analyze workflows previously unparseable due to YAML anchors and other complex constructs. → blog.trailofbits.com |
| 2026-05-19 2026 | How We Got a CISA GitHub Leak Taken Down in Under a Day intermediate 2 min read | Writeup details a CISA GitHub leak containing CI/CD logs, Kubernetes manifests, Terraform code, and AWS secrets discovered in the "Private-CISA" repository. The leak, which persisted for months before detection by GitGuardian, highlights risks from plain-text passwords, Git-committed backups, and exposed GitHub tokens. It emphasizes the importance of diligent secret management and comprehensive exposure monitoring to prevent similar incidents. → blog.gitguardian.com |
| 2026-05-19 2026 | CISA Admin Leaked AWS GovCloud Keys on Github news 4 min read | Writeup of CISA contractor's GitHub leak exposing AWS GovCloud keys, plaintext passwords for internal systems like "LZ-DSO", and Artifactory credentials. The leak, discovered by GitGuardian and validated by Seralys, highlighted poor security hygiene including disabling GitHub's secrets detection, storing passwords in plain text, and using easily guessable passwords. This incident represents a significant government data leak, potentially allowing attackers lateral movement and backdoor insertion into software packages. |
| 2026-05-08 2026 | How to mitigate secrets risk and prevent future breaches intermediate 9 min read | Library for detecting and managing secrets risk in code. It details how leaks of credentials, tokens, and signing keys in open source and proprietary repositories are a growing concern, with millions exposed on platforms like GitHub and npm. The library aids in situational awareness by identifying exposed secrets, understanding their purpose, and assessing their potential impact. It emphasizes investing in advanced tooling to filter false positives and prioritize active tokens, alongside evolving development practices to mitigate risks from the design stage forward, ultimately aiming to prevent future breaches. → reversinglabs.com |
| 2026-05-06 2026 | Secrets security: The why the how and what to do about it beginner 5 min read | Report detailing the epidemic of secrets exposed in software repositories, explaining how attackers exploit exposed environment variables, tokens, and keys on platforms like PyPI, npm, and GitHub, and offering guidance on mitigation strategies. It highlights the speed at which attackers find these secrets, often within seconds, and the long discovery times for security teams, referencing examples of exposed AWS credentials and discussions of defense-in-depth approaches to software supply chain security. → reversinglabs.com |
| 2026-05-05 2026 | Secrets leaks increase and expand beyond the codebase news 6 min read | Library for detecting secrets leaks, focusing on increased risks beyond codebases in collaboration and project management tools like Slack, Jira, and Confluence. It highlights that secrets found in these platforms are often more critical and harder to detect than those in source code, as these tools typically lack integrated scanning capabilities. The library aims to address this gap by providing solutions for monitoring these unstructured data streams, acknowledging that traditional scanning methods optimized for code repositories are insufficient. → reversinglabs.com |
| 2026-05-04 2026 | Local Guardrails for Secrets Security in the Age of AI Coding Assistants beginner 9 min read AI Supply Chain | Library for local secrets security scanning, ggshield, enables developers to detect and prevent accidental credential exposure directly within their workflows. It addresses the shifting attack surface towards developer workstations, encompassing AI coding assistants, local caches, and environment files. The tool scans project workspaces, dotfiles, build output, and agent folders to catch sensitive data before it propagates to repositories or pipelines, mitigating risks like those seen in npm, PyPI, and Docker Hub campaigns. → blog.gitguardian.com |
| 2026-05-02 2026 | Shai-Hulud Hits SAP: Stolen Credentials Found in 1200 GitHub Repos news 5 min read Supply Chain | Library variant of the Shai-Hulud worm targets SAP npm packages, exfiltrating developer credentials, tokens, and cloud configurations from over 2.2 million monthly downloads. The malware silently uploads this sensitive data, encrypted via AES-256-GCM and RSA-OAEP, to over 1,200 public GitHub repositories. Affected users are advised to immediately rotate keys, enforce two-factor authentication, upgrade packages, and treat compromised machines as fully breached. → ox.security |
| 2026-04-29 2026 | Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware news 3 min read Supply Chain | Library that installs malicious preinstall scripts in SAP-related npm packages, such as `@cap-js/sqlite` and `@cap-js/postgres`, to steal developer and CI/CD secrets. The "Mini Shai Hulud" campaign, attributed to TeamPCP, uses a multi-stage payload to harvest credentials from GitHub, npm, and cloud providers, exfiltrating data via GitHub repositories. It also features browser credential theft and propagation logic. → wiz.io |
| 2026-04-28 2026 | ClickUp is leaking customer data via hardcoded API key researcher claims news API Sec | A researcher claims ClickUp is leaking customer data due to a hardcoded API key. This vulnerability could expose sensitive information. → cybernews.com |
| 2026-04-27 2026 | Claude Code is leaking API keys into public package registries news 5 min read Supply Chain | Writeup on Claude Code API token leak, detailing how the AI assistant caches approved terminal commands containing sensitive credentials in `.claude/settings.local.json`. This hidden file, if not excluded from package builds, can expose API keys to public registries like npm. The vulnerability impacts various packaging ecosystems and bypasses traditional secret scanning tools, necessitating manual exclusion from `.npmignore` and `.gitignore`, or automated pipeline checks for enterprises. |
| 2026-04-22 2026 | UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours news 3 min read | Writeup of UNC6426's nx npm supply-chain attack, detailing how a compromised GitHub token and an overly permissive AWS OIDC trust were exploited to gain full AWS administrator access within 72 hours. The attack involved leveraging the `nx` package, the `pull_request_target` vulnerability, and the QUIETVAULT credential stealer, with reconnaissance aided by the Nord Stream tool. Recommendations include sandboxing package managers, applying least privilege to CI/CD roles, and enforcing fine-grained PATs. → thehackernews.com |
| 2026-04-22 2026 | The State of Non-Human Identity Security (CSA Survey Report) beginner 1 min read | Survey report detailing the state of non-human identity (NHI) security, including bots, API keys, and service accounts. It reveals that only 15% of organizations are highly confident in preventing NHI attacks, with major pain points in managing service accounts, auditing, and access management. The report highlights that 20% of organizations have formal processes for API key offboarding, and many use tools not purpose-built for NHIs, though investment in NHI security capabilities is increasing. |
| 2026-04-22 2026 | Secrets Management in 2026: Vault, AWS Secrets Manager, and Beyond beginner 4 min read | Library for understanding 2026 secrets management trends, comparing HashiCorp Vault, AWS Secrets Manager, Doppler, and Infisical. It highlights the shift from static to dynamic secrets, the importance of identity-based access, and the role of Kubernetes operators like External Secrets Operator. The library guides selection based on factors like multi-cloud needs, AWS dependency, developer experience priorities, and self-hosting requirements. |
| 2026-04-22 2026 | GitHub Secret Scanning 2026: New Patterns, Push Protection beginner 10 min read | Library for GitHub Secret Protection offers enhanced detection of leaked secrets with 28 new patterns across 15 providers, expanded push protection for 39 token types, and AI-powered generic password detection via Copilot. Available to GitHub Team plan customers at $19 per month per active committer, it includes validity checks and improved API visibility. This solution aims to prevent credential-related breaches, which cost an average of $4.88 million, by blocking pushes of sensitive information like Supabase service keys and Vercel API tokens before they reach repositories. |
| 2026-04-22 2026 | Top 10 Non-Human Identity Security Tools and Platforms for 2026 beginner 16 min read | Library for detecting and preventing non-human identity (NHI) security risks, specifically addressing hardcoded API keys, overprivileged service accounts, stale OAuth tokens, and misconfigured workload identities. It offers comprehensive discovery, exposure detection across git history and CI/CD pipelines, lifecycle management, authorization and least privilege enforcement, and governance features to aid compliance with standards like SOC 2 and ISO 27001. This tool targets large DevSecOps organizations to secure complex, multi-cloud, and ephemeral workloads. → blog.gitguardian.com |
| 2026-04-22 2026 | CVE-2026-5807: HashiCorp Vault DoS via Unauthenticated Root Token Generation news | Advisory on CVE-2026-5807 detailing a denial-of-service vulnerability in HashiCorp Vault. Unauthenticated attackers can exploit this by repeatedly initiating or canceling root token generation or rekey operations, preventing legitimate users from accessing these critical functions. This flaw is resolved in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. GitLab Dependency Scanning can detect and mitigate this specific vulnerability. → advisories.gitlab.com |
| 2026-04-22 2026 | CVE-2026-3605: HashiCorp Vault KVv2 Metadata Policy Bypass (DoS) news | Advisory for CVE-2026-3605 details a HashiCorp Vault KVv2 metadata policy bypass vulnerability. Authenticated users with specific glob policies can delete secrets outside their authorized scope, leading to a denial-of-service condition. The vulnerability does not permit cross-namespace deletion or unauthorized data reading. Patches are available in Vault Community Edition 2.0.0, Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. → advisories.gitlab.com |
| 2026-04-22 2026 | AI Is Fueling Secrets Sprawl: GitGuardian Reports 81% Surge of AI-Service Leaks news 3 min read | Report detailing GitGuardian's findings on secrets sprawl, highlighting an 81% surge in AI-service leaks and a 34% YoY increase in newly leaked secrets on GitHub due to AI adoption. The analysis covers increased risk from AI-assisted commits, emerging MCP configuration risks, expanded attack surfaces via collaboration tools and developer machines, and challenges in prioritizing and remediating long-lived secrets, underscoring the need for dedicated Non-Human Identity governance. → blog.gitguardian.com |
| 2026-04-22 2026 | HCSEC-2026-08: Vault DoS via Unauthenticated Root Token Generation news 1 min read | Bulletin detailing CVE-2026-5807, a denial-of-service vulnerability in HashiCorp Vault Community and Enterprise editions up to v1.21.4. Unauthenticated attackers can exploit the `sys/rekey`, `sys/generate-root`, and `sys/rekey-recovery-key` endpoints to repeatedly initiate or cancel root token generation or rekey operations, locking out legitimate users. This issue is resolved in Vault 2.0.0. |
| 2026-04-22 2026 | HCSEC-2026-05: Vault KVv2 Metadata Policy Bypass DoS news 1 min read | Writeup of CVE-2026-3605, a denial-of-service vulnerability in HashiCorp Vault KVv2. An authenticated user with specific policy configurations could delete secrets they weren't authorized for, leading to potential service disruption. This issue affected versions up to 1.21.4 and was fixed in Vault Community Edition 2.0.0 and various Vault Enterprise versions. |
| 2026-04-19 2026 | Compromised IAM Credentials Power Large AWS Crypto Mining Campaign news 3 min read | Analysis of an AWS crypto mining campaign details how attackers use compromised IAM credentials, including admin-like privileges, to gain access. The multi-stage attack involves credential validation via `RunInstances` with `DryRun`, role creation for ECS and Lambda, and deployment of malicious Docker images like `yenik65958/secret:user`. Persistence is achieved using `ModifyInstanceAttribute` to disable API termination and by creating Lambda functions. This campaign highlights the sophisticated use of AWS services for illicit cryptocurrency mining and the importance of strong IAM controls, temporary credentials, MFA, and least privilege. → thehackernews.com |
| 2026-04-19 2026 | Pre-Commit Hooks for Secret Detection: Setup in 10 Minutes intermediate 7 min read | Library for implementing pre-commit hooks to prevent secrets from entering Git history. It details the setup process for tools like gitleaks, detect-secrets, and TruffleHog, offering solutions for immediate detection and blocking of credential leaks. The library emphasizes catching secrets at the cheapest point in the lifecycle, preventing the need for costly history rewrites and incident response by integrating these tools seamlessly into the Git commit workflow. |
| 2026-04-19 2026 | Understanding Your Organization's Exposure to Secret Leaks — GitHub beginner 4 min read | Library for assessing an organization's exposure to secret leaks, highlighting that over 39 million secrets were detected on GitHub in 2024 alone. This resource details how secrets like API keys and passwords are leaked through repository commits or misconfigurations, referencing the $4.88 million average cost of credential compromise breaches and the 2022 LastPass breach. It provides methods for quantifying risk, including inventory audits and benchmarking against OWASP ASVS and NIST guidelines, and mentions GitHub's secret risk assessment tool for enterprise customers. |
| 2026-04-19 2026 | Exposed Developer Secrets Surge: AI Drives 34% Increase in 2025 news 5 min read | Report detailing a 34% surge in exposed developer secrets during 2025, fueled by AI-assisted coding and expanded use of tools like Claude Code. GitGuardian's analysis highlights significant increases in leaked AI service credentials, including DeepSeek API keys, and identifies internal repositories as a six-fold greater risk. The report also notes that 28% of exposures occur outside code in platforms like Slack and Jira, with 64% of discovered secrets remaining unrevoked. |
| 2026-04-19 2026 | GitHub Found 39M Secret Leaks in 2024 — The GitHub Blog news 5 min read | Library for GitHub Advanced Security, featuring Secret Protection and Code Security, addresses the pervasive issue of exposed secrets, which led to 39 million leaks on GitHub in 2024. It emphasizes built-in push protection for public repositories and introduces affordable standalone products and a free point-in-time scan for organizations to identify and manage secret exposures effectively, partnering with vendors like AWS and Google Cloud Platform to enhance detection accuracy. → github.blog |
| 2026-04-18 2026 | Product showcase: Stop secrets from leaking through AI coding tools with GitGuardian beginner 4 min read | Library extending ggshield with hook-based secret scanning for AI coding tools like Cursor and GitHub Copilot. This solution detects secrets in prompts and AI agent actions before they are sent to models or executed, providing real-time, preventive control for organizations to mitigate sensitive data exposure in AI workflows, addressing a critical blind spot in current security programs and complementing existing repository and CI pipeline scanning efforts. → helpnetsecurity.com |
| 2026-04-17 2026 | Non-human identities: What they are and how to secure them (Netwrix) beginner 11 min read | Guide to non-human identities (NHIs) and their security, detailing service accounts, API keys, managed identities, OAuth tokens, and cloud workload identities. The article highlights how these entities, lacking human oversight, MFA, and clear ownership, pose significant security risks, contributing to account compromises. It discusses authentication methods like token-based, key-based, certificate-based, and workload identity federation, emphasizing the absence of MFA as a critical vulnerability. Best practices, such as migrating to gMSAs for service accounts and addressing challenges with vendor-managed NHIs and token lifespans, are also covered, referencing the Netwrix 2025 Cybersecurity Trends Report. |
| 2026-04-17 2026 | What Are Non-Human Identities? Complete NHI Security Guide 2025 beginner 14 min read | Guide to Non-Human Identities (NHIs) covering their distinction from human accounts, their proliferation in modern organizations, and the five core characteristics that define them: built for automation, identity encoded in names, purpose-built design, operating in networks, and persistence without oversight. It details common NHI types including service accounts, API keys and tokens, machine identities and certificates, bots and automated agents, and application identities, emphasizing their critical role in security due to high privileges and continuous operation. |
| 2026-04-17 2026 | TruffleHog Open Source v3 vs GitGuardian beginner 3 min read | Library comparing TruffleHog Open Source v3 and GitGuardian's code security platform for secrets detection. TruffleHog is a CLI tool for finding hardcoded secrets in repositories, while GitGuardian offers an integrated platform with automated detection, Honeytoken capabilities, alerting, incident prioritization, and remediation workflows across various version control systems. GitGuardian aims to reduce false positives through its detection engine and provides enhanced collaboration, enterprise-grade features, and dedicated support, contrasting with TruffleHog's open-source limitations in scalability and built-in functionality. |
| 2026-04-17 2026 | git-secret-scanner: Find secrets with TruffleHog & Gitleaks beginner 2 min read | Tool for finding secrets in Git organizations and groups, combining TruffleHog's classification strengths with Gitleaks' broader detection capabilities. It supports GitHub and GitLab, utilizes specific tokens with required scopes, and offers features for ignoring secrets via annotations or fingerprint files, as well as baseline scanning to detect new secrets. |
| 2026-04-17 2026 | Gitleaks vs TruffleHog 2026 Benchmarks (AppSec Santa) beginner 8 min read | Library for open-source secret scanning, comparing Gitleaks and TruffleHog. Gitleaks excels as a fast, pre-commit hook using regex for rapid detection within git repositories. TruffleHog offers deeper scanning across git, S3 buckets, Docker images, and Slack, featuring credential verification to confirm active leaks, making it suitable for CI/CD pipelines. Most teams utilize both tools for comprehensive secret protection. → appsecsanta.com |
| 2026-04-17 2026 | Rafter: detect-secrets vs gitleaks vs TruffleHog beginner 9 min read | Library comparing `detect-secrets`, `git-secrets`, `gitleaks`, and `TruffleHog` for detecting leaked secrets. `git-secrets` is basic and AWS-focused. `detect-secrets` uses plugins and a baseline for brownfield repos, but has a higher false positive rate. `gitleaks` offers broad built-in coverage and fast scanning with 150+ rules. `TruffleHog` distinguishes itself by verifying found secrets via API calls, significantly reducing false positives by confirming active credentials. |
| 2026-04-17 2026 | SEC02-BP03 Store and use secrets securely (AWS Well-Architected) beginner 5 min read | Reference detailing AWS best practices for managing application secrets, emphasizing credential removal, replacement with short-term alternatives (like IAM roles), and secure storage and rotation of remaining long-term secrets using AWS Secrets Manager. It highlights benefits such as encrypted storage, audited access, and on-demand secret distribution, while warning against common anti-patterns like embedding credentials in source code or configuration files. The document also mentions tools like Amazon CodeGuru for identifying hard-coded secrets and Lambda extensions for serverless secret retrieval. |
| 2026-04-17 2026 | AWS Secrets Manager: Secure Credential Storage & Best Practices beginner 10 min read | Library for securely storing and managing sensitive data like database passwords, API keys, and OAuth tokens within AWS. It offers automatic credential rotation, fine-grained access control via AWS IAM, integration with AWS CloudTrail for monitoring, and allows applications to retrieve secrets at runtime using AWS SDKs, reducing the risk of hard-coded credentials in code, CI/CD pipelines, or Kubernetes manifests. |
| 2026-04-17 2026 | Practical steps to minimize key exposure using AWS Security (AWS) intermediate 13 min read | Library for minimizing AWS key exposure, this resource details practical steps for detecting exposed and unused access keys using Amazon Q Developer and AWS IAM Access Analyzer. It emphasizes implementing preventive guardrails with Service Control Policies (SCPs) and Resource Control Policies (RCPs) to establish data perimeters and restrict credential usage to expected networks. The guide also touches upon using AWS WAF and Amazon Inspector for network-level controls and automated secret rotation for ongoing security hygiene, addressing common threat actor entry points via compromised long-term credentials. → aws.amazon.com |
| 2026-04-17 2026 | AWS API Keys / Secrets / Tokens Exposure Remediation intermediate 2 min read | Guide to remediating exposed AWS API keys, secrets, and tokens, emphasizing PCI-DSS compliance. The guide details using Cyera DSPM for AI-powered discovery across EC2, Lambda, and code repositories, followed by step-by-step remediation including disabling compromised keys, updating applications, and migrating secrets to AWS Secrets Manager or Systems Manager Parameter Store. It also covers long-term prevention through automated rotation, IAM roles, and least-privilege policies. |
| 2026-04-17 2026 | Integrating HashiCorp Vault with Kubernetes for Secrets Mgmt intermediate 8 min read | Library for integrating HashiCorp Vault with Kubernetes for secure secrets management. This resource details deploying Vault using Helm in a Kubernetes cluster, enabling the Kubernetes authentication method, and configuring Vault to communicate with the Kubernetes API. It covers creating roles that map Kubernetes service accounts to Vault policies, enabling the Key/Value (kv) secrets engine, and storing secrets like database passwords. The integration leverages Vault's encryption at rest, dynamic secrets generation, and fine-grained access control to overcome limitations of native Kubernetes secrets. |
| 2026-04-17 2026 | HashiCorp Vault Kubernetes: The Definitive Guide (Plural) beginner 24 min read | Guide to integrating HashiCorp Vault with Kubernetes, focusing on replacing static secrets with dynamic, short-lived credentials for databases and PKI. It covers automating secret injection into pods using the Vault Agent Injector or Secrets Operator, and centralizing security policy and configuration. The guide highlights how Vault's dynamic secrets and centralized auditing significantly enhance security compared to native Kubernetes Secrets, with platforms like Plural aiding consistent deployment across fleets. |
| 2026-04-17 2026 | A Hands-On Guide to Vault in Kubernetes beginner | A Hands-On Guide to Vault in Kubernetes |
| 2026-04-17 2026 | Securing Kubernetes Secrets with HashiCorp Vault (InfraCloud) intermediate 13 min read | Library for securing Kubernetes secrets with HashiCorp Vault, this resource details how to configure Vault for high availability and implement automatic unsealing using Azure Key Vault. It covers creating Azure services like Key Vault and App Registration, then demonstrates deploying Vault with its Helm chart, specifying Azure Key Vault integration for unsealing and Raft for storage. The setup aims to overcome the limitations of Kubernetes native secrets by providing a centralized and robust secret management system. |
| 2026-04-17 2026 | Manage Kubernetes native secrets with Vault Secrets Operator intermediate 12 min read | Library for managing Kubernetes native secrets with HashiCorp Vault. The Vault Secrets Operator (VSO) acts as a Kubernetes operator, syncing secrets between Vault and Kubernetes native secrets in specified namespaces. It supports kv-v1 and kv-v2, TLS certificates via PKI, and static and dynamic secrets. The tutorial demonstrates installation of Vault and VSO using Helm on minikube, configuring Kubernetes authentication, KV secrets engine, and a role for accessing a static secret. |
| 2026-04-17 2026 | Secret detection (GitLab Docs) beginner 2 min read | Library for detecting and preventing secrets in Git repositories. It offers "secret push protection" to block commits containing secrets, "pipeline secret detection" that scans branches within CI/CD, and "client-side secret detection" for issues and merge request comments. GitLab can automatically revoke exposed secrets and provides vulnerability reports for remediation. The "GitLab Duo" feature helps reduce false positives by analyzing findings. |
| 2026-04-17 2026 | Find secrets with GitHub secret risk assessment beginner 1 min read | Tool for scanning GitHub organizations for secret leaks, providing insights into public exposures, private exposures, and token types. Available on GitHub Team and Enterprise plans starting April 1, 2025, this assessment helps identify affected repositories and the number of secrets leaked per type, offering a clear view of an organization's secret footprint without storing or sharing specific secrets. → github.blog |
| 2026-04-17 2026 | About secret scanning (GitHub Docs) beginner 3 min read | Library for automatically detecting credential leaks like API keys and passwords committed to repositories. It scans Git history, issue and pull request descriptions, wikis, and gists for exposed secrets. The library generates alerts upon detection, allowing for immediate credential rotation. It supports expanding detection with non-provider and custom patterns, and includes validity checks to prioritize remediation. GitHub also partners with service providers to notify them of detected partner secrets, and offers AI-powered scanning via Copilot. |