Aug 28, 2025
Nx S1ngularity Attack: The Workflow-to-npm Token Path
The documented August 2025 Nx attack path, exact affected versions, workstation indicators, and issuer-side response—without an invented victim count.
Ben Kim
May 29, 2025
2025 DBIR: what credential abuse and third-party breaches mean for teams
A sourced reading of the 2025 Verizon DBIR, with practical steps for credential inventory, leak prevention, and response.
Ben Kim
Apr 27, 2025
Vercel secret exposure: check your Next.js browser bundle
Find where Next.js puts environment values in client output, distinguish public and secret Stripe keys, and replace a key exposed in a deployment.
Ben Kim
Apr 25, 2025
OWASP NHI5: How to Review Excess Machine Permissions
Compare workload needs, issuer grants, effective access, and observed use before reducing an NHI’s permissions.
Ben Kim
Apr 23, 2025
A rotation record is not a map of leaked credentials
Lifecycle records show intended access. Secret findings show copies in scanned sources. Compare both before deciding who should replace a key.
Ben Kim
Apr 22, 2025
OWASP NHI4:2025 — how to review insecure authentication
Insecure authentication is more than a leaked key. Review OAuth flows, static credentials, token scope, and the rollout path for safer workload access.
Ben Kim
Apr 18, 2025
Where credentials escape a CI/CD pipeline
A key can land in Git history, build output or a published image. Use a different check at each boundary and verify any exposure at its issuer.
Ben Kim
Apr 16, 2025
MCP and A2A security: trace the credentials between agents and tools
MCP connects agents to tools; A2A connects agents to each other. Map authentication, token scope, and exposed credentials at every hop.
Ben Kim
Apr 14, 2025
Secret scanning before and after a Git push
A key caught before push can be removed from the change. A key found afterward needs issuer-side revocation or rotation, even if the commit is deleted.
Ben Kim
Apr 14, 2025
A credential in an S3 object: what to check next
A key-shaped string in S3 does not prove public access, a live credential, or misuse. Check the object, issuer, scan coverage, and earlier versions.
Ben Kim
Apr 4, 2025
Data breach costs: what an exposed key finding can tell you
A breach-cost average cannot price one exposed credential. Record the key’s source, issuer status, available access and activity evidence, and response work before estimating impact.
Ben Kim
Apr 1, 2025
Human vs. non-human identity: what changes in access review?
A person and a workload can both have privileged access. Compare the principal, credential, owner and offboarding record you need to review each one.
Ben Kim
Don't miss the next one
A short monthly brief on credential security from Cremit.