#Secrets Management
All CosmicBytez Labs articles tagged #Secrets Management, across news, security advisories, how-to guides, and projects.
- News
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack the Release Pipeline
LiteLLM's post-mortem: a master key committed publicly in May and never revoked led to stolen GitHub tokens and the malicious 1.107.0 release on PyPI and...
- News
Railway Warns Developers to Rotate Secrets After Possible Breach of Customer Environment Variables
Railway says an intruder may have accessed encrypted environment variables, paused builds platform-wide, and urged all users to rotate API keys and credentials.
- News
Zeabur Shutting Down After Second Security Breach in Two Months
Plaintext internal credentials let an attacker take 3.2M env-variable records and data on 321,810 accounts. Zeabur will close by December 31, 2026.
- HOWTO
Detecting Leaked Secrets in Git Repos with Gitleaks
Stop shipping API keys, tokens, and passwords to GitHub. Learn how to scan git history, enforce pre-commit hooks, and integrate Gitleaks into your CI/CD...
- News
Over 1,000 Charities Hit by Beacon CRM Data Breach
Over 1,000 UK charities affected after Beacon CRM suffered a data breach traced to an exposed AWS access key in public JS files.
- News
Lessons Learned from CISA's Recent GitHub Leak
CISA has published a postmortem on a data leak in which a contractor exposed dozens of internal credentials — including AWS GovCloud keys — in a public...
- News
Novo Nordisk Breach Exposes Software Development Pipeline Risk
A leaked GitHub token at Novo Nordisk has exposed a fundamental flaw in how organizations approach secrets management — treating it as a tooling problem...
- News
SailPoint to Acquire Entro in Reported $200 Million Deal
SailPoint's acquisition of Israeli startup Entro adds non-human identity and secrets management to its IGA platform, addressing a critical gap as machine...
- HOWTO
HashiCorp Vault: Centralized Secrets Management for Modern
Deploy and configure HashiCorp Vault to securely store, rotate, and audit secrets across your infrastructure — covering installation, auth methods,...
- Project
HashiCorp Vault: Secrets Management for Your Homelab and Apps
Deploy HashiCorp Vault to centrally manage secrets, certificates, and dynamic credentials — eliminating hardcoded passwords from your infrastructure with...
- HOWTO
How to Secure GitHub Actions Workflows with OIDC, SHA
Harden your CI/CD pipeline by replacing long-lived secrets with OIDC short-lived tokens, pinning third-party actions to commit SHAs, enforcing...