Apr 15, 2026
The "Out of Scope" Loophole: Why Bug Bounties Look Away From Credential Exposure
An organization's core credentials sat in public repositories for years. The security industry's answer: "Out of scope."
Ben Kim
Apr 14, 2026
Deleted file, active credential: investigating a Zombie Key
Source removal does not revoke a credential. Check the issuer, Git history, current owner, and last verification before closing the finding.
Ben Kim
Apr 11, 2026
One API key in three repositories: investigating shared credentials
Three observed locations are not a complete dependency map. Check key type, issuer status, permissions, and actual consumers before replacement.
Ben Kim
Apr 10, 2026
Long-exposed credentials: what a 90-day source record tells you
An old source record and an active key do not establish key age. Check when the value appeared, issuer status, permissions, and dependencies.
Ben Kim
Apr 5, 2026
API keys in incident chats and tickets: what to investigate
A credential outside a repository needs a source-access review, issuer check, owner, and verified response. A finding alone does not prove misuse.
Ben Kim
Apr 2, 2026
Orphaned API keys after offboarding: what the evidence shows
An active key linked to an inactive author is a lead. Check the directory, source, issuer, and current service owner before deciding what happened.
Ben Kim
Mar 25, 2026
When the Security Scanner Became the Weapon: A Cyber Kill Chain Analysis of the Trivy Supply Chain Attack
Aqua Security's Trivy was compromised by TeamPCP, cascading into LiteLLM. A 7-phase Cyber Kill Chain and MITRE ATT&CK analysis of how incomplete credential rotation turned a single breach into a five-ecosystem catastrophe.
Ben Kim
Mar 17, 2026
Public API key in a repository: what to check first
A public commit proves exposure, not misuse. Check validity, permissions, issuer logs, and dependent workloads before closing the incident.
Ben Kim
Mar 7, 2026
Clinejection: prompt injection and the unauthorized Cline CLI release
Cline’s issue-triage agent exposed a path to publishing credentials. A later unauthorized CLI release installed OpenClaw; Cline found no user data theft.
Ben Kim
Jan 26, 2026
Git secret scanning in 2026: coverage, setup, and response
A practical guide to push protection, history scans, validity checks, and issuer-side response, with GitHub, GitLab, and Gitleaks source links.
Ben Kim
Bybit Hack: What the Safe Wallet Investigation Found
The February 2025 theft involved a compromised Safe developer and a manipulated transaction interface. Here is what investigators confirmed and what remains unknown.
Ben Kim
Dec 26, 2025
Can You Prove a Leaked API Key Was Sold?
A public leak, a valid key, and evidence of misuse are different findings. Here is how to investigate each without claiming a sale you cannot prove.
Ben Kim
Don't miss the next one
A short monthly brief on credential security from Cremit.