FIELD NOTES / FOR DEVELOPERS
Better configuration.
Better ways to work.
Practical guides to environment variables, secret management, and team access. Written for the people building the next project.
Google Agent Registry: Check Findings Before Approving a Skill
Google’s new skill scanning controls need a careful rollout. Read findings, check existing revisions and review the client access available when an agent runs.
More from the field.
17 guidesREX CVE-2026-122193: Find the SSM Documents Your Setup Guide Created
AWS’s November 6 REX advisory concerns SSM documents created from a setup example. A practical agency guide to finding copies, retiring affected infrastructure and reviewing credential exposure.
Vercel Schedules: Check What Your Preview Jobs Can Reach
Vercel’s November 5 Schedules beta brings jobs to Preview branches and custom environments. Review migration methods, trigger authentication and client credentials before enabling them.
Kernel’s Security Incident: Beyond Rotating One API Key
Kernel’s November 4 incident notice raises a browser-agent access question: what happens to issued connection URLs, saved profiles and client sessions after key rotation?
Supabase CLI v3: Your Green Build Might Only Be Local
Supabase CLI v3 changes database targets, hosted confirmations and environment precedence. An agency checklist to verify what each client deployment actually changed.
AWS KPL CVE-2026-119117: Check Process Arguments and Logs
AWS’s new KPL advisory covers credential exposure in native-process arguments and DEBUG logs. An agency guide to affected versions, deployed consumers and recovery.
GitHub’s AI Push Protection: An Agency Rollout Checklist
GitHub’s October 28 preview can block unstructured secrets using code context. An agency guide to rollout costs, blocked commits and credential handling.
Render’s Scoped API Keys: Give Each Integration Its Own Access
Render’s October 27 private beta separates API capabilities. A practical agency guide to monitoring, deployment and secret access, with a validation checklist.
Cloudflare’s Resumable Agents: Check Access Before They Act
Cloudflare’s October 26 agent update makes approval waits durable. An agency guide to current access checks, scoped credentials, and repeatable actions.
LiteLLM’s Supply Chain Attack: What Agencies Should Rotate
LiteLLM’s October 2026 report traces a malicious release to a leaked key that stayed valid. A practical revocation and recovery guide for software agencies.
PHP and Node.js CVEs: What Software Agencies Need to Patch Now
A practical guide to the October 2026 PHP and Node.js security updates: affected versions, PHP's follow-up advisory, deployment checks, and secret exposure.
Developer Offboarding: Revoke Access and Rotate Shared Secrets
A practical developer offboarding checklist: remove account access, rotate shared API keys, update running services, and verify old credentials stop working.
Why I Built Keyrua for Software Development Teams
Searching Slack for the right .env file is a frustration software agencies recognize. That experience at my previous company is why I built Keyrua.
AI Agent Secrets Management: Why Autonomous Agents Get Credentials Wrong
AI agents in production often hold far more credentials than they need. Here's what goes wrong with AI agent secrets management, and how to fix it.
CI/CD Secret Management: What Most Pipelines Get Wrong
Most CI/CD pipelines handle secrets incorrectly: leaking them in logs, over-scoping access, or relying on base64 masking. Here's how to fix it.
LLMjacking: How Attackers Steal AI API Keys and Run Up Your Bill
LLMjacking is a fast-growing attack where stolen API keys are used to consume expensive AI inference at your cost. Here's how it works and how to stop it.
How to Share .env Files Securely with Your Development Team
Most teams share API keys over Slack or email. Here's why that's a security risk, and how modern dev teams handle it properly.
Environment Variable Best Practices Every Developer Should Know
A practical guide to managing secrets, API keys, and configuration across environments, from local development to production.
LESS FRICTION. MORE TIME TO BUILD.
Put it into practice.
Give your next project a shared starting point. Try Keyrua with a dummy .env file.