Jul 19, 2026
AI agent credentials: trace the tool, issuer and responder
An agent workflow may cross several identity boundaries. Trace the actual grant, source location, permissions and owner before judging a leaked key.
Ben Kim
Back to Blog
Tag
GitHub
6 posts
Jul 15, 2026
The machine access behind an exposed API key
An exposed key is a lead. Connect it to its issuer, principal, permissions, workload, and owner before closing the access path.
Ben Kim
Apr 14, 2026
Deleted file, active credential: investigating a Zombie Key
Source removal does not revoke a credential. Check the issuer, Git history, current owner, and last verification before closing the finding.
Ben Kim
Mar 25, 2026
When the Security Scanner Became the Weapon: A Cyber Kill Chain Analysis of the Trivy Supply Chain Attack
Aqua Security's Trivy was compromised by TeamPCP, cascading into LiteLLM. A 7-phase Cyber Kill Chain and MITRE ATT&CK analysis of how incomplete credential rotation turned a single breach into a five-ecosystem catastrophe.
Ben Kim
Aug 28, 2025
Nx S1ngularity Attack: The Workflow-to-npm Token Path
The documented August 2025 Nx attack path, exact affected versions, workstation indicators, and issuer-side response—without an invented victim count.
Ben Kim
Apr 27, 2025
Vercel secret exposure: check your Next.js browser bundle
Find where Next.js puts environment values in client output, distinguish public and secret Stripe keys, and replace a key exposed in a deployment.
Ben Kim