secrets-management
Safeguard articles tagged "secrets-management" — guides, analysis, and best practices for software supply chain and application security.
98 articles
Uber (2016): Hardcoded Credentials in a Private Repository
A factual retrospective on the 2016 Uber breach, where attackers used credentials found in a private GitHub repository to access an AWS account holding rider and driver data, and how it was later concealed.
A CVSS 10.0 That Only Reads Files: GitLab CVE-2026-85706
An unauthenticated attacker reads arbitrary files from a GitLab server. There is no code execution, and it still scores 10.0 — because on a source host a read primitive is a credential incident.
Hardcoded credentials vulnerabilities explained
Hardcoded credentials (CWE-798) have caused real breaches at Uber, Toyota, and Mercedes-Benz. Here's how they happen, how common they are, and how to fix them.
Secrets leakage in Docker images explained
How credentials get baked into Docker image layers, real incidents that exposed them, and how to detect and stop secrets leakage in container images.
Every Supply Chain Attack of June and July 2026 Was After the Same Thing
Nine incidents in eight weeks: a PyPI worm, typosquatted payment SDKs, jscrambler, AsyncAPI, Hugging Face, Polymarket, Nx Console, Medtronic, AdaptHealth. Nine different vectors, one prize — credentials sitting in developer environments and build pipelines. If you fix one thing this quarter, fix that.
Container registry credential leak trends
2026 data shows container registry credential leaks accelerating as CI pipelines speed up — and why layer-aware scanning, not just final-image checks, is now essential.
Repo Security: How to Secure Your Git Repositories End to End
Repo security covers access, secrets, branch protection, dependencies, and CI/CD. Here is a practical checklist to lock down your Git repositories against the ways they actually get compromised.
Anatomy of the Codecov Bash Uploader compromise
A single altered line in Codecov's Bash Uploader ran undetected for 65 days, siphoning CI secrets from thousands of pipelines before anyone noticed.
Best secrets management and vaulting solutions
A buyer's guide to secrets management tools: evaluation criteria plus honest comparisons of Vault, AWS Secrets Manager, CyberArk, Doppler, and Infisical.
Securing Secrets and Environment Variables in GitHub Actions
A tag-pinned GitHub Action used by 23,000+ repos was rewritten to dump CI memory in March 2025 — here's how OIDC and SHA-pinning would have stopped it.
Exposed .git Directories and the Git Internals That Leak Your Source
Roughly 4.96 million IPs expose .git metadata today, and over 252,000 leak live credentials in .git/config — a 2018-era bug that never went away.
Lessons from the CircleCI 2023 secrets breach
A stolen session cookie bypassed 2FA and let attackers read secrets from live memory. CircleCI's own timeline shows what fast rotation actually requires.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.