Start here

Every guide on this blog is sourced, dated and tested where it shows commands. Pick the situation you are in.

A secret just leaked

Act in this order.

  1. 1. I leaked an API key: the 15-minute response playbook

    A leaked API key is usable within minutes. The order that works: replace the key, kill the old one, check for abuse, find every copy, then clean Git history.

  2. 2. Rotate a secret everywhere without downtime

    Rotating a secret is easy; finding every copy and restarting in order is not. A tested walkthrough of previewed rotation, same-everywhere versus unique, and sessions.

  3. 3. You committed .env to Git: remove it, then do the part everyone skips

    Remove a committed .env from Git history with git filter-repo, then do what actually makes it safe: rotate the keys, clean the copies and stop it happening again. Tested.

  4. 4. You pasted an API key into ChatGPT or Claude: what now?

    If a key went into an AI chat, treat it as exposed. Replace it, check usage, then understand retention: what two providers document, what we could not verify.

A package you use was compromised

Contain first, then rotate, then shrink what the next one can take.

  1. 1. An npm package you use was compromised: the first-hour playbook

    What to do in the first hour after a malicious npm release like Shai-Hulud: check exposure, contain, rotate in the right order, and shrink the next blast radius.

  2. 2. Why can a postinstall script read your production secret?

    Every npm worm steals the same thing: the credentials already in the install environment. A tested demo, the four layers that cut the loot, and what each one can't do.

  3. 3. After tj-actions: keeping secrets safe in GitHub Actions

    The tj-actions/changed-files compromise leaked CI secrets from logs. What happened, a tested check for unpinned actions, and layers that limit what a bad action can take.

A critical CVE was announced

Decide fast whether it is yours, then prove the fix landed.

  1. 1. How to respond to a critical CVE when you have no security team

    A five-question decision tree and time boxes for a small team: is it exploited, do you run it, is it reachable, can you fix it, and how to prove the fix landed.

  2. 2. Am I affected by the Next.js and React Server Components CVEs? How to check

    How to tell if your Next.js app is vulnerable to React2Shell and the October 2026 Next.js RCEs: the version ranges, why npm ls react misleads, and what to do.

  3. 3. Fail your CI build on known vulnerable dependencies (no account needed)

    Add one step to GitHub Actions or GitLab CI that fails the build on known vulnerable dependencies, with thresholds, JSON gating and what leaves your runner. Tested.

  4. 4. Get alerted when a new CVE hits what you're running in production

    How to be told when a vulnerability affects the packages your running services actually have installed: boot, change and six-hourly checks, count-only alerts, tested.

  5. 5. Too many Dependabot alerts? Triage by what actually runs

    A triage method for Dependabot alert overload: use GitHub's free filters, group by package, then check what is exploited, reachable and actually deployed. Tested script.

  6. 6. 50,000 CVEs a year, and under 1% on the exploited list: the numbers

    NVD published about 50,000 CVEs in 2025, up from 19,000 in 2020, while CISA's exploited list grows slowly. The counts, a script to reproduce them, and their limits.

Using AI agents with real credentials

What they can reach, and how to give them less.

  1. 1. AI agent secrets management: what it is and how to do it

    How to give AI coding agents what they need without handing them your secrets: the threat model, a five-level maturity model, a checklist, and what Dynv does.

  2. 2. Can Claude Code read your .env? What the 2026 incidents show

    Yes, if the file is in your workspace. What Anthropic documents, a CVE, a leak into npm packages and a poisoned extension, with the checks and fixes that work.

  3. 3. MCP security checklist: eight ways it goes wrong, and how to check yours

    A practical MCP security checklist built on real incidents: secrets in configs, unpinned or malicious servers, CVEs and over-broad access, plus a browser config checker.

  4. 4. Give Claude Code or Cursor access to your env vars, safely (MCP setup)

    Connect an AI agent to your environment variables over MCP with a read-only token, masked values and dry runs. Tested setup, then what the agent can and can't do.

Changing config without redeploys

Live delivery and zero-downtime rotation.

  1. 1. Update environment variables without restarting your Node app

    You can't change process.env from outside a running process. Four ways to get new values in without a redeploy, and a tested demo that swaps a database pool live.

  2. 2. Rotate a database password with zero downtime in Node

    Changing a database password first breaks new connections. A tested two-role pattern with a live pool swap shows 0 failed queries, against 46 for the naive order.

  3. 3. The .env file is over: what replaces it, and how to migrate in ten minutes

    A .env file leaks through Git, AI agents, build logs and laptops. The options that replace it, a tested ten-minute migration, and what you give up.

Choosing a secrets tool

Comparisons that say what the others do better.

  1. 1. Doppler alternatives in 2026: what to compare, and when Dynv fits

    Doppler alternatives compared on price, encryption model, live updates and agent safety, with prices read from vendor pages and what each does better than Dynv.

  2. 2. HCP Vault Secrets is retired: what to move to

    HashiCorp sunset HCP Vault Secrets. What its own notice says, the options it names, other routes to consider, and how to migrate without losing values.

Free tools

Prefer the full list? All articles. Product docs: Dynv docs.