Topic
The practice of generating, storing, rotating, and revoking authentication secrets—passwords, API keys, tokens—used to access systems and data.
Instinct's AI agent, from a startup valued at $10bn this week, read a stored test card number and passwords back in plain text in an investor's test. For employers whose staff use personal agents, the open question this quarter is which credentials belong in an agent's vault at all.
Reality
AWS lets an S3 presigned URL live up to seven days, and anyone holding a leaked one can use it until it expires or its signer is revoked. Revoking the signer kills every URL it made, so short expiries and a bucket-level cap on signature age are the practical defence.
Reality
GitHub Enterprise Cloud lets an admin clear SSO authorizations for personal access tokens, SSH keys and app user tokens across every organization at once, while deleting the credentials themselves stays limited to Enterprise Managed Users.
Reality
The approval gates on credential access and activation are the real engineering in n8n's preview chat builder. The plan credits it burns on debugging are metered long before any workflow gets switched on.
Reality
An operator's log of four rotations across two self-hosted n8n instances puts every failure in a consumer copy, a derived URL token, or a hardcoded header, and none of the three tripped an alert.
Reality
A dev.to walkthrough splits database connection risk into passive observer, man in the middle, and the password sitting on your laptop. Each has a different defender.
Reality