Credentials

Cybersecurity 09 Sep 2026 10 min read

Keep Package Publishing Credentials Out of Untrusted Builds

A build job often needs to compile code, run tests, and create an artifact. It usually does not need permission to publish a new version that other people will install. That distinction matters because build systems process code and configuration that change frequently. A pull request, dependency update, test helper, build script, or compromised developer account can influence what runs during a build. If every such build also receives a long-lived package registry credential, code that only needed to be tested may inherit authority to release software.

Cybersecurity Software Supply Chain

Cybersecurity 08 Sep 2026 12 min read

Separate Credentials by Environment

A development environment often needs the same kinds of integrations as production: a database, an object store, an email provider, a payment sandbox, or an internal API. Reusing one credential across those environments can look convenient because there is only one value to provision and rotate. The cost appears when a lower-trust environment is compromised. If a credential copied into development also works against production, the attacker has crossed an environment boundary without defeating another authentication control. A secret that was intended to simplify configuration has become a bridge between systems with different risk.

Cybersecurity Secrets Management

Cybersecurity 03 Sep 2026 6 min read

Manage Application Secrets Safely

Applications depend on sensitive values such as API keys, database passwords, signing keys, client secrets, and service credentials. These values often provide direct access to data or privileged operations, so protecting them requires more than keeping them out of source code. Good secrets management controls the entire lifecycle: creation, storage, delivery, use, rotation, revocation, and incident response. Treat secrets as credentials, not configuration A useful distinction is whether disclosure of a value would let an attacker authenticate, decrypt protected information, forge trusted data, or perform privileged actions.

Cybersecurity Secrets Management