https://dynv.dev/blog/ Guides and incident playbooks on secrets, supply-chain attacks, CVEs and AI-agent security. en Sun, 01 Nov 2026 00:00:00 GMT https://dynv.dev/blog/ai-agent-secrets-management/ https://dynv.dev/blog/ai-agent-secrets-management/ Sun, 01 Nov 2026 00:00:00 GMT How to give AI coding agents what they need without handing them your secrets: the threat model, a five-level maturity model, a checklist, and what Dynv does. https://dynv.dev/blog/alert-when-a-new-cve-hits-what-you-run/ https://dynv.dev/blog/alert-when-a-new-cve-hits-what-you-run/ Sun, 01 Nov 2026 00:00:00 GMT How to be told when a vulnerability affects the packages your running services actually have installed: boot, change and six-hourly checks, count-only alerts, tested. https://dynv.dev/blog/am-i-affected-by-the-nextjs-react-cve/ https://dynv.dev/blog/am-i-affected-by-the-nextjs-react-cve/ Sun, 01 Nov 2026 00:00:00 GMT How to tell if your Next.js app is vulnerable to React2Shell and the October 2026 Next.js RCEs: the version ranges, why npm ls react misleads, and what to do. https://dynv.dev/blog/canary-secrets-catch-a-leaked-token/ https://dynv.dev/blog/canary-secrets-catch-a-leaked-token/ Sun, 01 Nov 2026 00:00:00 GMT Plant a fake token beside your real secrets and get an alert with IP and user agent when anyone uses it. A tested walkthrough, the alert fields, and the limits. https://dynv.dev/blog/canary-urls-own-domain-and-listener/ https://dynv.dev/blog/canary-urls-own-domain-and-listener/ Sun, 01 Nov 2026 00:00:00 GMT URL canaries alert when anyone requests a fake webhook URL. How to point them at your own domain or a listener you run, what we tested, and what is not usable yet. https://dynv.dev/blog/claude-code-env-leak/ https://dynv.dev/blog/claude-code-env-leak/ Sun, 01 Nov 2026 00:00:00 GMT Yes, if the file is in your workspace. What Anthropic documents, a CVE, a leak into npm packages and a poisoned extension, with the checks and fixes that work. https://dynv.dev/blog/cve-fatigue-the-numbers/ https://dynv.dev/blog/cve-fatigue-the-numbers/ Sun, 01 Nov 2026 00:00:00 GMT NVD published about 50,000 CVEs in 2025, up from 19,000 in 2020, while CISA's exploited list grows slowly. The counts, a script to reproduce them, and their limits. https://dynv.dev/blog/doppler-alternatives/ https://dynv.dev/blog/doppler-alternatives/ Sun, 01 Nov 2026 00:00:00 GMT Doppler alternatives compared on price, encryption model, live updates and agent safety, with prices read from vendor pages and what each does better than Dynv. https://dynv.dev/blog/fail-ci-on-vulnerable-dependencies/ https://dynv.dev/blog/fail-ci-on-vulnerable-dependencies/ Sun, 01 Nov 2026 00:00:00 GMT Add one step to GitHub Actions or GitLab CI that fails the build on known vulnerable dependencies, with thresholds, JSON gating and what leaves your runner. Tested. https://dynv.dev/blog/github-actions-secrets-after-tj-actions/ https://dynv.dev/blog/github-actions-secrets-after-tj-actions/ Sun, 01 Nov 2026 00:00:00 GMT The tj-actions/changed-files compromise leaked CI secrets from logs. What happened, a tested check for unpinned actions, and layers that limit what a bad action can take. https://dynv.dev/blog/give-claude-code-and-cursor-env-access-safely/ https://dynv.dev/blog/give-claude-code-and-cursor-env-access-safely/ Sun, 01 Nov 2026 00:00:00 GMT Connect an AI agent to your environment variables over MCP with a read-only token, masked values and dry runs. Tested setup, then what the agent can and can't do. https://dynv.dev/blog/hcp-vault-secrets-alternatives/ https://dynv.dev/blog/hcp-vault-secrets-alternatives/ Sun, 01 Nov 2026 00:00:00 GMT HashiCorp sunset HCP Vault Secrets. What its own notice says, the options it names, other routes to consider, and how to migrate without losing values. https://dynv.dev/blog/how-to-respond-to-a-critical-cve/ https://dynv.dev/blog/how-to-respond-to-a-critical-cve/ Sun, 01 Nov 2026 00:00:00 GMT A five-question decision tree and time boxes for a small team: is it exploited, do you run it, is it reachable, can you fix it, and how to prove the fix landed. https://dynv.dev/blog/i-leaked-an-api-key-what-now/ https://dynv.dev/blog/i-leaked-an-api-key-what-now/ Sun, 01 Nov 2026 00:00:00 GMT A leaked API key is usable within minutes. The order that works: replace the key, kill the old one, check for abuse, find every copy, then clean Git history. https://dynv.dev/blog/mcp-security-checklist/ https://dynv.dev/blog/mcp-security-checklist/ Sun, 01 Nov 2026 00:00:00 GMT A practical MCP security checklist built on real incidents: secrets in configs, unpinned or malicious servers, CVEs and over-broad access, plus a browser config checker. https://dynv.dev/blog/npm-supply-chain-attack-playbook/ https://dynv.dev/blog/npm-supply-chain-attack-playbook/ Sun, 01 Nov 2026 00:00:00 GMT What to do in the first hour after a malicious npm release like Shai-Hulud: check exposure, contain, rotate in the right order, and shrink the next blast radius. https://dynv.dev/blog/pasted-an-api-key-into-an-ai-chat/ https://dynv.dev/blog/pasted-an-api-key-into-an-ai-chat/ Sun, 01 Nov 2026 00:00:00 GMT If a key went into an AI chat, treat it as exposed. Replace it, check usage, then understand retention: what two providers document, what we could not verify. https://dynv.dev/blog/remove-env-file-from-git-history/ https://dynv.dev/blog/remove-env-file-from-git-history/ Sun, 01 Nov 2026 00:00:00 GMT Remove a committed .env from Git history with git filter-repo, then do what actually makes it safe: rotate the keys, clean the copies and stop it happening again. Tested. https://dynv.dev/blog/rotate-database-password-zero-downtime-node/ https://dynv.dev/blog/rotate-database-password-zero-downtime-node/ Sun, 01 Nov 2026 00:00:00 GMT Changing a database password first breaks new connections. A tested two-role pattern with a live pool swap shows 0 failed queries, against 46 for the naive order. https://dynv.dev/blog/rotate-secrets-everywhere-without-downtime/ https://dynv.dev/blog/rotate-secrets-everywhere-without-downtime/ Sun, 01 Nov 2026 00:00:00 GMT Rotating a secret is easy; finding every copy and restarting in order is not. A tested walkthrough of previewed rotation, same-everywhere versus unique, and sessions. https://dynv.dev/blog/the-env-file-is-over/ https://dynv.dev/blog/the-env-file-is-over/ Sun, 01 Nov 2026 00:00:00 GMT A .env file leaks through Git, AI agents, build logs and laptops. The options that replace it, a tested ten-minute migration, and what you give up. https://dynv.dev/blog/too-many-dependabot-alerts/ https://dynv.dev/blog/too-many-dependabot-alerts/ Sun, 01 Nov 2026 00:00:00 GMT A triage method for Dependabot alert overload: use GitHub's free filters, group by package, then check what is exploited, reachable and actually deployed. Tested script. https://dynv.dev/blog/update-env-vars-without-restarting-node/ https://dynv.dev/blog/update-env-vars-without-restarting-node/ Sun, 01 Nov 2026 00:00:00 GMT You can't change process.env from outside a running process. Four ways to get new values in without a redeploy, and a tested demo that swaps a database pool live. https://dynv.dev/blog/why-can-postinstall-read-your-production-secret/ https://dynv.dev/blog/why-can-postinstall-read-your-production-secret/ Sun, 01 Nov 2026 00:00:00 GMT Every npm worm steals the same thing: the credentials already in the install environment. A tested demo, the four layers that cut the loot, and what each one can't do.