Signal SentrySearchUpdated Nov 2, 05:30 UTCAM Drop
Security lens · Identity and access

Short-lived secrets, kept out of code

A key or token lifted from a laptop, repository or log stops working soon, and there is no secret in code to find.

Where to start

Our reading of the guidance below, for a small team. A starting point, not a complete program.

  1. Move API keys and tokens out of code, config files and shell profiles into a secrets manager.
  2. Prefer tokens that expire on their own, and rotate the long-lived ones on a schedule.
  3. Scan commits for secrets before they are pushed, and revoke any secret that was ever committed.

The guidance

  1. OWASP · Secrets Management Cheat Sheet

    You should regularly rotate secrets so that any stolen credentials will only work for a short time.

  2. OWASP · CI/CD Security Cheat Sheet

    Secrets should never be hardcoded in code repositories or CI/CD configuration files.

Short quotes from the official guidance, linked. Read the source before you act on it.

Incidents from the Drops

Security

Cisco Talos: Volta infostealer sends stolen data to an LLM to rank victims' worth

Talos says Volta steals browser passwords, OAuth tokens and SSH and cloud keys, then sends a victim dossier through OpenRouter to Claude Opus 4.6, falling back to Kimi K2 and Gemini 2.5 Flash on refusals.

Why it matters: Talos says the model does the attacker's triage work. Check how fast tokens and keys on developer machines expire and can be revoked; Talos did not track in-the-wild use, per Wired.

Preliminary Way in: an infostealer on a Windows PC that lifts browser tokens, SSH keys and cloud keys

Controls that would have helped:

Cisco Talos · Oct 31Wired · Oct 31
From Drop #058 · Sat, Oct 31, 2026 · Evening
SecurityFollowing since Oct 30, 2026in 2 Drops

Cursor: backdoored Claude Code extension reached at most 5,000 users; two versions hit

Phorion's updated write-up says Cursor now names versions 2.1.312 and 2.1.313 as affected. Ars Technica says Cursor put the exposure at no more than 5,000 users and that Anthropic had not yet publicly warned customers.

Why it matters: Cursor extensions auto-update by default, Phorion's CTO told Ars. If you installed or updated it on Thursday, check the listed indicators and rotate keys that machine held.

Confirmed Way in: a malicious extension update published through the vendor's official marketplace account

Controls that would have helped:

Ars Technica · Oct 30Phorion · Oct 31Hacker News · Oct 30
From Drop #057 · Sat, Oct 31, 2026 · Morning