A client found one of their API keys in a public error log. Tracing where that key actually lived took longer than fixing the leak — and revealed a secrets management problem nobody wanted to own.
- Published On
security
- The Axios supply chain attack reminded me of a dependency audit I ran at a client last year. What I found was worse than any vulnerability scanner could flag.
- Published On
Tags
consulting (51)debugging (23)architecture (17)developer-experience (17)reliability (15)performance (9)devops (9)ai (8)observability (7)code-quality (6)database (5)kubernetes (4)postgres (4)productivity (3)technical-debt (3)microservices (3)testing (3)engineering-culture (3)code-review (2)deployment (2)databases (2)security (2)opentelemetry (2)monitoring (2)postgresql (2)ci-cd (2)tooling (2)javascript (2)goals (2)api-design (1)nodejs (1)memory (1)configuration (1)error-handling (1)secrets-management (1)webhooks (1)infrastructure (1)resilience (1)containers (1)environments (1)queues (1)cloud (1)cost-optimization (1)orm (1)refactoring (1)on-call (1)alerting (1)incident-management (1)typescript (1)distributed-systems (1)caching (1)platform-engineering (1)dependencies (1)feature-flags (1)api (1)contracts (1)logging (1)mongodb (1)migration (1)workflow (1)nestjs (1)angular (1)sandbox (1)sonarcube (1)learning (1)journey (1)mdx (1)