Trestle Articles Guides on finding, fixing, and preventing leaked secrets: responding when a key leaks, how secret scanning works, and how Trestle can help. https://trestlescan.com/articles/ 2026-06-30T01:00:00.000Z Trestlehttps://trestlescan.com/ AST vs regex secret scanning: what each approach catches and misses https://trestlescan.com/articles/ast-vs-regex-secret-scanning/ 2026-06-30T01:00:00.000Z 2026-06-30T01:00:00.000Z Regex matches known key formats and entropy scoring catches high-randomness strings, but both miss generic passwords and raise false positives on ordinary code. Parser-based scanning reads code structure and catches what patterns miss, while regex stays the better choice for fixed-format keys. The B1-B4 trust boundary model for AI coding agents https://trestlescan.com/articles/b1-b4-trust-boundaries/ 2026-06-29T01:00:00.000Z 2026-06-29T01:00:00.000Z A pipeline threat model maps AI coding agent security onto four boundaries, from the developer's prompt to production: what each boundary is, the threats and control at each, and where hardcoded secrets fit. Deleting a secret and committing again isn't enough https://trestlescan.com/articles/deleting-secret-is-not-enough/ 2026-06-26T01:00:00.000Z 2026-06-26T01:00:00.000Z If you deleted a committed secret and pushed again, the secret still works. The old value stays in your git history, in forks, and in clones. The only fix is to replace the key. How fast are leaked API keys found? https://trestlescan.com/articles/how-fast-are-leaked-keys-found/ 2026-06-25T01:00:00.000Z 2026-06-25T01:00:00.000Z On public GitHub, a leaked API key is found and used within minutes, sometimes within one minute. You can't outrun it, so replace the key first, not the commit. Leaked secret emergency checklist https://trestlescan.com/articles/leaked-secret-checklist/ 2026-06-24T01:00:00.000Z 2026-06-24T01:00:00.000Z A do-it-now checklist for a leaked API key, token, or password: contain it, check for misuse, and prevent a repeat. Replace the key first. Optionally, clean it out of your git history. API key leak prevention: how to keep secrets out of your code https://trestlescan.com/articles/api-key-leak-prevention/ 2026-06-22T01:00:00.000Z 2026-06-22T01:00:00.000Z A practical, vendor-neutral guide to API key leak prevention: why credentials leak, what it costs, and the layered defenses that stop secrets from escaping your codebase. Four secret scanners compared on four codebases https://trestlescan.com/articles/secret-scanners-compared/ 2026-06-17T01:00:00.000Z 2026-06-17T01:00:00.000Z Trestle, Gitleaks, TruffleHog, and detect-secrets run with default settings over four public codebases. Every scanner catches an obvious API key. The differences show up with the secrets that don't look like secrets: hashed passwords, weak passwords, credit card numbers, and values that get sent to the browser.