Jul 15, 2026
The machine access behind an exposed API key
An exposed key is a lead. Connect it to its issuer, principal, permissions, workload, and owner before closing the access path.
Ben Kim
Back to Blog
Tag
Git Security
5 posts
Apr 14, 2026
Deleted file, active credential: investigating a Zombie Key
Source removal does not revoke a credential. Check the issuer, Git history, current owner, and last verification before closing the finding.
Ben Kim
Mar 17, 2026
Public API key in a repository: what to check first
A public commit proves exposure, not misuse. Check validity, permissions, issuer logs, and dependent workloads before closing the incident.
Ben Kim
Jan 26, 2026
Git secret scanning in 2026: coverage, setup, and response
A practical guide to push protection, history scans, validity checks, and issuer-side response, with GitHub, GitLab, and Gitleaks source links.
Ben Kim
Aug 28, 2025
Nx S1ngularity Attack: The Workflow-to-npm Token Path
The documented August 2025 Nx attack path, exact affected versions, workstation indicators, and issuer-side response—without an invented victim count.
Ben Kim