A review of 100 public workflow samples and Uber repository events shows four collector versions. We examine deleted-key collection through Git patches, successful exits after transfer failure, and credential-based response priorities.
A leaked Slack incoming webhook is usually triaged as low severity: write-only, one channel, no data access. The moment an AI agent reads that channel and can act with tools, that write-only primitive becomes an indirect prompt injection path into the agent's privileges. Here is the full kill chain, the exact preconditions, and how to defend it.
Full writeup of the AITU CTF Final (April 25-26, 2026), a HackCity-format competition. We walk through exploiting DMZ hosts via XXE, SSTI, and SQLi, pivoting into the DEV segment through AD lateral movement, escaping a privileged Docker container via cgroup abuse, and breaching a healthcare system through JWT JKU header injection.
Two source types show two observed locations, not how a credential moved. Check access, issuer status, owner, and actual consumers.
An old source record and an active key do not establish key age. Check when the value appeared, issuer status, permissions, and dependencies.
A credential outside a repository needs a source-access review, issuer check, owner, and verified response. A finding alone does not prove misuse.
Aqua Security's Trivy was compromised by TeamPCP, cascading into LiteLLM. A 7-phase Cyber Kill Chain and MITRE ATT&CK analysis of how incomplete credential rotation turned a single breach into a five-ecosystem catastrophe.
A practical guide to push protection, history scans, validity checks, and issuer-side response, with GitHub, GitLab, and Gitleaks source links.
A key can land in Git history, build output or a published image. Use a different check at each boundary and verify any exposure at its issuer.
Optional cookies count visits, identify visiting companies, and measure ads. You can decline. Cookie policy