Articles
Guides on finding, fixing, and preventing leaked secrets: responding when a key leaks, how secret scanning works, and how Trestle can help.
AST vs regex secret scanning: what each approach catches and misses
Regex matches known key formats and entropy scoring catches high-randomness strings, but both miss generic passwords and raise false positives on ordinary code. Parser-based scanning reads code structure and catches what patterns miss, while regex stays the better choice for fixed-format keys.
Secret scanning.
The B1-B4 trust boundary model for AI coding agents
A pipeline threat model maps AI coding agent security onto four boundaries, from the developer's prompt to production: what each boundary is, the threats and control at each, and where hardcoded secrets fit.
AI agent security.
Deleting a secret and committing again isn't enough
If you deleted a committed secret and pushed again, the secret still works. The old value stays in your git history, in forks, and in clones. The only fix is to replace the key.
Incident response.
How fast are leaked API keys found?
On public GitHub, a leaked API key is found and used within minutes, sometimes within one minute. You can't outrun it, so replace the key first, not the commit.
Threat research.
Leaked secret emergency checklist
A do-it-now checklist for a leaked API key, token, or password: contain it, check for misuse, and prevent a repeat. Replace the key first. Optionally, clean it out of your git history.
Incident response.
API key leak prevention: how to keep secrets out of your code
A practical, vendor-neutral guide to API key leak prevention: why credentials leak, what it costs, and the layered defenses that stop secrets from escaping your codebase.
Guide.
Four secret scanners compared on four codebases
Trestle, Gitleaks, TruffleHog, and detect-secrets run with default settings over four public codebases. Every scanner catches an obvious API key. The differences show up with the secrets that don't look like secrets: hashed passwords, weak passwords, credit card numbers, and values that get sent to the browser.
Tool comparison.