Trestle Articles https://trestlescan.com/articles/ Guides on finding, fixing, and preventing leaked secrets: responding when a key leaks, how secret scanning works, and how Trestle can help. en Tue, 30 Jun 2026 01:00:00 GMT AST vs regex secret scanning: what each approach catches and misses https://trestlescan.com/articles/ast-vs-regex-secret-scanning/ https://trestlescan.com/articles/ast-vs-regex-secret-scanning/ Regex matches known key formats and entropy scoring catches high-randomness strings, but both miss generic passwords and raise false positives on ordinary code. Parser-based scanning reads code structure and catches what patterns miss, while regex stays the better choice for fixed-format keys. Secret scanning Tue, 30 Jun 2026 01:00:00 GMT The B1-B4 trust boundary model for AI coding agents https://trestlescan.com/articles/b1-b4-trust-boundaries/ https://trestlescan.com/articles/b1-b4-trust-boundaries/ A pipeline threat model maps AI coding agent security onto four boundaries, from the developer's prompt to production: what each boundary is, the threats and control at each, and where hardcoded secrets fit. AI agent security Mon, 29 Jun 2026 01:00:00 GMT Deleting a secret and committing again isn't enough https://trestlescan.com/articles/deleting-secret-is-not-enough/ https://trestlescan.com/articles/deleting-secret-is-not-enough/ If you deleted a committed secret and pushed again, the secret still works. The old value stays in your git history, in forks, and in clones. The only fix is to replace the key. Incident response Fri, 26 Jun 2026 01:00:00 GMT How fast are leaked API keys found? https://trestlescan.com/articles/how-fast-are-leaked-keys-found/ https://trestlescan.com/articles/how-fast-are-leaked-keys-found/ On public GitHub, a leaked API key is found and used within minutes, sometimes within one minute. You can't outrun it, so replace the key first, not the commit. Threat research Thu, 25 Jun 2026 01:00:00 GMT Leaked secret emergency checklist https://trestlescan.com/articles/leaked-secret-checklist/ https://trestlescan.com/articles/leaked-secret-checklist/ A do-it-now checklist for a leaked API key, token, or password: contain it, check for misuse, and prevent a repeat. Replace the key first. Optionally, clean it out of your git history. Incident response Wed, 24 Jun 2026 01:00:00 GMT API key leak prevention: how to keep secrets out of your code https://trestlescan.com/articles/api-key-leak-prevention/ https://trestlescan.com/articles/api-key-leak-prevention/ A practical, vendor-neutral guide to API key leak prevention: why credentials leak, what it costs, and the layered defenses that stop secrets from escaping your codebase. Guide Mon, 22 Jun 2026 01:00:00 GMT Four secret scanners compared on four codebases https://trestlescan.com/articles/secret-scanners-compared/ https://trestlescan.com/articles/secret-scanners-compared/ Trestle, Gitleaks, TruffleHog, and detect-secrets run with default settings over four public codebases. Every scanner catches an obvious API key. The differences show up with the secrets that don't look like secrets: hashed passwords, weak passwords, credit card numbers, and values that get sent to the browser. Tool comparison Wed, 17 Jun 2026 01:00:00 GMT