Blog
Notes on credential brokering, zero-knowledge encryption, and keeping secrets away from the agents that use them.
Security
Your coding agent will hand over your API key if asked nicely
An instruction in a pull-request title was enough to make three major coding agents post their own credentials to the thread. The fix isn't a better agent — it's not giving the agent a credential at all.
read →PatternsCredential brokering for AI agents, without running a vault
What a credential broker is, the four properties that separate one from an open proxy, and the question most comparisons skip: after the broker, who can still read the key?
read →TrustWhat happens to your secrets if seekrit disappears
Every secrets manager is a single point of failure for everything you deploy. Exactly what you keep if we shut down — the signed archive, the offline decryptor, the custodian quorum — and where the answer stops.
read →