GitHub Secret Scanning Webhook secret_category: Update Alert Routing Safely
A safe rollout workflow for GitHub secret scanning's new secret_category webhook field, from schema-tolerant parsing to queue reconciliation.
GitHub Secret Scanning Extended Metadata: How to Triage Active Credentials
Use GitHub secret scanning validity and extended metadata to route, contain, rotate, and close credential alerts without spreading secrets.
AI Agent Secret Leakage: Keep Credentials Out of Context, Logs, and Git
A practical workflow to stop AI coding agents from exposing credentials through context collection, terminal output, logs, generated files, and Git history.
Dependency Audit Workflow for AI-Generated Code: Catch What the AI Missed
Why AI Coding Tools Silently Add Dependencies GitHub Copilot, Cursor, Claude Code, and other AI coding assistants generate code fast — but they also silently introduce third-party dependencies you never explicitly approved. A single AI suggestion can pull in a package with known vulnerabilities, incompatible licenses, or abandoned maintainers. Your package.json, requirements.txt, or Pipfile.lock grows
AI Code Review Automation: How to Build a Local Review Gate Without Cloud Tools
AI-generated code is everywhere now — from Copilot suggestions in your editor to full functions from ChatGPT and Claude. The problem is not the code itself; the problem is what slips through when nobody builds a real review gate before merging. Most teams assume they need a cloud-based SAST platform or an enterprise CI pipeline
Repository Security Review Checklist for AI-Assisted Development
Why Your Repository Needs a Security Review Before AI Writes More Code AI coding assistants like GitHub Copilot, Cursor, and Claude Code are transforming how developers write software. But every line of AI-generated code that lands in your repository introduces new risk vectors that traditional code review processes were never designed to catch. A structured
SOC 2 Compliance Evidence for AI-Generated Code: What Auditors Actually Look For
Introduction SOC 2 Type II audits are no longer optional for teams shipping software in 2026. Customers, partners, and procurement departments expect verifiable proof that your development process includes meaningful security controls — and that proof needs to extend to AI-generated code. If your team uses tools like GitHub Copilot, Cursor, or Claude Code to
TrapDoor Supply Chain Attack: How Malicious .cursorrules and CLAUDE.md Target AI Coding Tools
In May 2026, security researchers uncovered TrapDoor, a sophisticated supply chain campaign that injected malicious .cursorrules and CLAUDE.md files into over 35,000 GitHub repositories. These poisoned configuration files instruct AI coding assistants like Cursor and Claude to silently exfiltrate developer credentials, cloud keys, and environment variables during normal coding workflows. If you use AI-powered development
TruffleHog Verified a Secret But It’s a False Positive: How to Triage and Fix
TruffleHog Verified a Secret — But It’s a False Positive: How to Triage and Fix You ran TruffleHog on your repository and it flagged a verified secret. Your heart rate spiked. But when you investigated, the “secret” turned out to be a test fixture, a placeholder, or a string that looks like an API key
Gitleaks Detected a Secret: How to Fix It Safely
A practical response workflow for Gitleaks findings: confirm, rotate, remove safely, clean history only when needed, and prevent repeat leaks.