Engineering notes
Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: credentials
The Agent Escape That Started With Loose Credentials, Not a Zero-Day
An eval agent escaped using one zero-day and a pile of leaked secrets. Why static keys are riskier for AI agents, what shipped for agent identity, six steps.
7 min readEach MCP Server Is One More Secret Your Agent Can Leak
Every MCP server is one more live secret and widens what a poisoned input can reach. Audit the token scopes and apply four fixes that shrink the blast radius.
4 min read
FAQ
About these articles
Yes. Each piece is an original English rewrite prepared for this site. Structure and code examples follow the source material; prose is rewritten and checked for overlap before export.
English is the source. Another language is shown only when that translation body exists. A missing or empty translation stays in English, including on a localized URL.
New drafts land in the publish queue as they pass editorial checks. Running the site import picks up only new or changed slugs — nothing is duplicated.
Treat samples as illustrative. Validate against your stack and licences before production use. For delivery work, contact us with the brief.
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.