TAG · Security
Security
Stacking policy: defaults + fine-grained overrides for high-value secrets
We built a real ABAC policy engine on top of the identity and step-up work. You can now express 'everything under LLM/* needs a human in the loop' as a default, while stacking a more specific rule that says only …
What shipping a WebAuthn flow actually looks like
Phase 1 piece #4 and Phase 1b-C were both marked complete based on unit tests. Then I drove a real browser ceremony and five bugs cascaded out at once.
Multi-principal zero-trust identity: humans, devices, workloads, and agents
Classic identity models handle one principal type at a time. Real systems have four interacting simultaneously — and most auth stacks are not built for that.
The airport-recovery demo: losing your laptop and recovering in two minutes
Lose the laptop at the gate, buy a new one, be back in your secrets in under two minutes. Here is what that actually looks like.
The GitHub VS Code Extension Breach, in Threat-Model Terms
GitHub's internal repos got exfiltrated through a poisoned VS Code extension. Here's the threat model that actually matters — and what credential-storage architecture can and can't do about it.
When a credential leaks, you know everything in 30 seconds
GitHub emails you at 2am about a leaked token. Old world: rotate everything, file a ticket, investigation takes a week. New world: one command, 30 seconds, ticket closed.
AI coding agents make the secrets problem worse. Here's the fix.
When your AI coding agent runs, it should see the Anthropic key and the project context — not your production database password. Unless you explicitly said so.
Your .env files are a liability — even when they never leave your machine
Your .env never touched git. The password leaked anyway. Nine separate places, depending on which tools you used that afternoon. Here's the better model.
I had 47 places I stored secrets. Then I built this.
A few weeks ago I went hunting for an API key. I found my secrets in 47 places. Here's what I built to fix that.