Pinned Tweet
What if you could debug with AI without ever leaking a credential?
That's why we made SecureIntent.
The first browser-level extension that intercepts secrets before they reach any AI model.
Just install it. It does the rest.
And we're just getting started -
- Mozilla Firefox Desktop app launching soon
One tool. Every platform. Zero leaks.
secureintent.ai
That's why we made SecureIntent.
The first browser-level extension that intercepts secrets before they reach any AI model.
Just install it. It does the rest.
And we're just getting started -
- Mozilla Firefox Desktop app launching soon
One tool. Every platform. Zero leaks.
secureintent.ai
31
9
50
18,199
🚨 Fireworks AI just expanded its October security incident disclosure.
The November 9 update revealed that attackers accessed:
-> Account and billing information
-> Stored secrets
-> Some customer datasets
-> A subset of incomplete model weights
The incident involved access through a third-party cloud provider hosting Fireworks' R&D machines.
Payment card numbers were not affected, according to Fireworks.
The bigger lesson?
Your security perimeter doesn't end at your own infrastructure.
Every third-party provider you trust becomes part of your attack surface.
The November 9 update revealed that attackers accessed:
-> Account and billing information
-> Stored secrets
-> Some customer datasets
-> A subset of incomplete model weights
The incident involved access through a third-party cloud provider hosting Fireworks' R&D machines.
Payment card numbers were not affected, according to Fireworks.
The bigger lesson?
Your security perimeter doesn't end at your own infrastructure.
Every third-party provider you trust becomes part of your attack surface.
0
0
1
20
Secureintent.ai retweeted
Your Claude Code settings file might be exposing your secrets.
Researchers found 1,122 public GitHub copies of:
`.claude/settings.local.json`
containing at least one secret.
Why?
Claude Code can save previously approved commands - including commands containing passwords, tokens or API keys.
Deleting the file isn't enough.
Git history and forks can preserve the leak.
If you've exposed a credential:
-> Rotate it immediately.
-> Remove it from repository history.
-> Audit other exposed secrets.
Your AI coding configuration is part of your security perimeter.
Researchers found 1,122 public GitHub copies of:
`.claude/settings.local.json`
containing at least one secret.
Why?
Claude Code can save previously approved commands - including commands containing passwords, tokens or API keys.
Deleting the file isn't enough.
Git history and forks can preserve the leak.
If you've exposed a credential:
-> Rotate it immediately.
-> Remove it from repository history.
-> Audit other exposed secrets.
Your AI coding configuration is part of your security perimeter.
1
1
7
240
Your Claude Code settings file might be exposing your secrets.
Researchers found 1,122 public GitHub copies of:
`.claude/settings.local.json`
containing at least one secret.
Why?
Claude Code can save previously approved commands - including commands containing passwords, tokens or API keys.
Deleting the file isn't enough.
Git history and forks can preserve the leak.
If you've exposed a credential:
-> Rotate it immediately.
-> Remove it from repository history.
-> Audit other exposed secrets.
Your AI coding configuration is part of your security perimeter.
Researchers found 1,122 public GitHub copies of:
`.claude/settings.local.json`
containing at least one secret.
Why?
Claude Code can save previously approved commands - including commands containing passwords, tokens or API keys.
Deleting the file isn't enough.
Git history and forks can preserve the leak.
If you've exposed a credential:
-> Rotate it immediately.
-> Remove it from repository history.
-> Audit other exposed secrets.
Your AI coding configuration is part of your security perimeter.
1
1
7
240
Secureintent.ai retweeted
Ever pasted 10,000 lines of logs into an AI assistant to debug an issue?
What if those logs contain API keys, access tokens, or database credentials?
Meet SecureIntent's Ghost Log Sanitizer.
It detects sensitive information hidden in large log dumps before they reach AI tools.
accidentally share your secrets.
Your logs contain more than errors. 🔐
What if those logs contain API keys, access tokens, or database credentials?
Meet SecureIntent's Ghost Log Sanitizer.
It detects sensitive information hidden in large log dumps before they reach AI tools.
accidentally share your secrets.
Your logs contain more than errors. 🔐
0
1
3
176
Ever pasted 10,000 lines of logs into an AI assistant to debug an issue?
What if those logs contain API keys, access tokens, or database credentials?
Meet SecureIntent's Ghost Log Sanitizer.
It detects sensitive information hidden in large log dumps before they reach AI tools.
accidentally share your secrets.
Your logs contain more than errors. 🔐
What if those logs contain API keys, access tokens, or database credentials?
Meet SecureIntent's Ghost Log Sanitizer.
It detects sensitive information hidden in large log dumps before they reach AI tools.
accidentally share your secrets.
Your logs contain more than errors. 🔐
0
1
3
176
Secureintent.ai retweeted
Chainalysis just revealed a much bigger security concern.
Its latest breach update confirmed exposure of:
-> Usernames
-> Password hashes
-> Live authentication tokens
Here's what developers need to understand:
A stolen password hash is dangerous.
But an exposed live session token can be even more immediately useful.
Attackers may not need your password if they can reuse an active session.
Protect your credentials.
Revoke exposed sessions.
Rotate compromised API keys.
Authentication security doesn't end with passwords.
Its latest breach update confirmed exposure of:
-> Usernames
-> Password hashes
-> Live authentication tokens
Here's what developers need to understand:
A stolen password hash is dangerous.
But an exposed live session token can be even more immediately useful.
Attackers may not need your password if they can reuse an active session.
Protect your credentials.
Revoke exposed sessions.
Rotate compromised API keys.
Authentication security doesn't end with passwords.
3
2
5
220
Chainalysis just revealed a much bigger security concern.
Its latest breach update confirmed exposure of:
-> Usernames
-> Password hashes
-> Live authentication tokens
Here's what developers need to understand:
A stolen password hash is dangerous.
But an exposed live session token can be even more immediately useful.
Attackers may not need your password if they can reuse an active session.
Protect your credentials.
Revoke exposed sessions.
Rotate compromised API keys.
Authentication security doesn't end with passwords.
Its latest breach update confirmed exposure of:
-> Usernames
-> Password hashes
-> Live authentication tokens
Here's what developers need to understand:
A stolen password hash is dangerous.
But an exposed live session token can be even more immediately useful.
Attackers may not need your password if they can reuse an active session.
Protect your credentials.
Revoke exposed sessions.
Rotate compromised API keys.
Authentication security doesn't end with passwords.
3
2
5
220
15 malicious JetBrains plugins were caught stealing AI API keys from developers.
they posed as AI coding assistants. two of them passed 25,000 downloads.
not source code. not passwords.
AI keys, specifically.
attackers have worked out which credentials are worth taking.
the fewer places your keys get pasted and stored, the less there is to steal.
they posed as AI coding assistants. two of them passed 25,000 downloads.
not source code. not passwords.
AI keys, specifically.
attackers have worked out which credentials are worth taking.
the fewer places your keys get pasted and stored, the less there is to steal.
0
1
2
158
Secureintent.ai retweeted
Your stolen AI API key could cost your company $100,000+ in a single day.
Google Threat Intelligence reports attackers hijacking cloud AI access, running models on victims' accounts, and reselling that access.
The risk isn't just data theft.
It's unauthorized compute.
Unexpected bills.
Abused API quotas.
Compromised cloud accounts.
Treat AI API keys like production credentials.
Because attackers might see them as a business opportunity.
Google Threat Intelligence reports attackers hijacking cloud AI access, running models on victims' accounts, and reselling that access.
The risk isn't just data theft.
It's unauthorized compute.
Unexpected bills.
Abused API quotas.
Compromised cloud accounts.
Treat AI API keys like production credentials.
Because attackers might see them as a business opportunity.
0
1
3
97
Your stolen AI API key could cost your company $100,000+ in a single day.
Google Threat Intelligence reports attackers hijacking cloud AI access, running models on victims' accounts, and reselling that access.
The risk isn't just data theft.
It's unauthorized compute.
Unexpected bills.
Abused API quotas.
Compromised cloud accounts.
Treat AI API keys like production credentials.
Because attackers might see them as a business opportunity.
Google Threat Intelligence reports attackers hijacking cloud AI access, running models on victims' accounts, and reselling that access.
The risk isn't just data theft.
It's unauthorized compute.
Unexpected bills.
Abused API quotas.
Compromised cloud accounts.
Treat AI API keys like production credentials.
Because attackers might see them as a business opportunity.
0
1
3
97
Secureintent.ai retweeted
Your AI coding agent needs access to your code.
But does it really need access to your production database?
The problem with AI agents isn't just what they can generate.
It's what they're allowed to execute.
A safer setup:
-> Read-only access by default.
-> Separate credentials for each environment.
-> Human approval for sensitive actions.
-> Short-lived tokens.
-> Restricted network and API permissions.
Don't give an AI agent the keys to your entire infrastructure just because it can write code.
Autonomy without boundaries is a security risk.
But does it really need access to your production database?
The problem with AI agents isn't just what they can generate.
It's what they're allowed to execute.
A safer setup:
-> Read-only access by default.
-> Separate credentials for each environment.
-> Human approval for sensitive actions.
-> Short-lived tokens.
-> Restricted network and API permissions.
Don't give an AI agent the keys to your entire infrastructure just because it can write code.
Autonomy without boundaries is a security risk.
12
1
8
234
Your AI coding agent needs access to your code.
But does it really need access to your production database?
The problem with AI agents isn't just what they can generate.
It's what they're allowed to execute.
A safer setup:
-> Read-only access by default.
-> Separate credentials for each environment.
-> Human approval for sensitive actions.
-> Short-lived tokens.
-> Restricted network and API permissions.
Don't give an AI agent the keys to your entire infrastructure just because it can write code.
Autonomy without boundaries is a security risk.
But does it really need access to your production database?
The problem with AI agents isn't just what they can generate.
It's what they're allowed to execute.
A safer setup:
-> Read-only access by default.
-> Separate credentials for each environment.
-> Human approval for sensitive actions.
-> Short-lived tokens.
-> Restricted network and API permissions.
Don't give an AI agent the keys to your entire infrastructure just because it can write code.
Autonomy without boundaries is a security risk.
12
1
8
234
Secureintent.ai retweeted
Malware used to steal your credentials.
Now, some malware is learning how to understand what it steals.
Cisco Talos researchers uncovered Volta-Autodoxer, an infostealer that can use AI models to analyze stolen data and build detailed victim profiles.
Passwords, cookies, tokens, financial data.
The scary part isn't just data theft.
It's what attackers can do with the information afterward.
Your credentials are valuable. Your digital identity is even more valuable.
Now, some malware is learning how to understand what it steals.
Cisco Talos researchers uncovered Volta-Autodoxer, an infostealer that can use AI models to analyze stolen data and build detailed victim profiles.
Passwords, cookies, tokens, financial data.
The scary part isn't just data theft.
It's what attackers can do with the information afterward.
Your credentials are valuable. Your digital identity is even more valuable.
2
1
6
160
Malware used to steal your credentials.
Now, some malware is learning how to understand what it steals.
Cisco Talos researchers uncovered Volta-Autodoxer, an infostealer that can use AI models to analyze stolen data and build detailed victim profiles.
Passwords, cookies, tokens, financial data.
The scary part isn't just data theft.
It's what attackers can do with the information afterward.
Your credentials are valuable. Your digital identity is even more valuable.
Now, some malware is learning how to understand what it steals.
Cisco Talos researchers uncovered Volta-Autodoxer, an infostealer that can use AI models to analyze stolen data and build detailed victim profiles.
Passwords, cookies, tokens, financial data.
The scary part isn't just data theft.
It's what attackers can do with the information afterward.
Your credentials are valuable. Your digital identity is even more valuable.
2
1
6
160
Secureintent.ai retweeted
You installed a coding extension to write code faster.
It installed an SSH backdoor instead. 💀
A malicious Claude Code extension reportedly appeared on Cursor's marketplace and targeted developer machines.
Up to 5,000 downloads were reported.
Let that sink in.
Your IDE extensions, dependencies and developer tools are all part of your attack surface.
Would you blindly trust an extension just because it's on a marketplace? 👀
It installed an SSH backdoor instead. 💀
A malicious Claude Code extension reportedly appeared on Cursor's marketplace and targeted developer machines.
Up to 5,000 downloads were reported.
Let that sink in.
Your IDE extensions, dependencies and developer tools are all part of your attack surface.
Would you blindly trust an extension just because it's on a marketplace? 👀
8
1
11
209
Your .env file might be more valuable to attackers than your source code.
Trigger.dev disclosed unauthorized access to environment variables belonging to a subset of organizations.
Think about what's inside:
• Database passwords
• API keys
• Cloud tokens
• Payment credentials
A single exposed secret can open doors far beyond one application.
Protect your secrets. Rotate exposed keys. Never paste them blindly into AI tools.
Your production credentials deserve more than a .gitignore.
Trigger.dev disclosed unauthorized access to environment variables belonging to a subset of organizations.
Think about what's inside:
• Database passwords
• API keys
• Cloud tokens
• Payment credentials
A single exposed secret can open doors far beyond one application.
Protect your secrets. Rotate exposed keys. Never paste them blindly into AI tools.
Your production credentials deserve more than a .gitignore.
3
1
6
142
Secureintent.ai retweeted
Your .env file might be more valuable to attackers than your source code.
Trigger.dev disclosed unauthorized access to environment variables belonging to a subset of organizations.
Think about what's inside:
• Database passwords
• API keys
• Cloud tokens
• Payment credentials
A single exposed secret can open doors far beyond one application.
Protect your secrets. Rotate exposed keys. Never paste them blindly into AI tools.
Your production credentials deserve more than a .gitignore.
Trigger.dev disclosed unauthorized access to environment variables belonging to a subset of organizations.
Think about what's inside:
• Database passwords
• API keys
• Cloud tokens
• Payment credentials
A single exposed secret can open doors far beyond one application.
Protect your secrets. Rotate exposed keys. Never paste them blindly into AI tools.
Your production credentials deserve more than a .gitignore.
3
1
6
142
Secureintent.ai retweeted
Your AI coding assistant is now part of your attack surface.
New SpyCloud research says infostealers are targeting tokens, session data and credentials from Claude Code, Codex, Cursor and GitHub Copilot.
More than 130,000 WardenStealer infections recovered since August.
AI access is valuable.
And attackers know it.
Are you protecting your AI credentials like your cloud credentials?
New SpyCloud research says infostealers are targeting tokens, session data and credentials from Claude Code, Codex, Cursor and GitHub Copilot.
More than 130,000 WardenStealer infections recovered since August.
AI access is valuable.
And attackers know it.
Are you protecting your AI credentials like your cloud credentials?
2
1
4
219
Your AI coding assistant is now part of your attack surface.
New SpyCloud research says infostealers are targeting tokens, session data and credentials from Claude Code, Codex, Cursor and GitHub Copilot.
More than 130,000 WardenStealer infections recovered since August.
AI access is valuable.
And attackers know it.
Are you protecting your AI credentials like your cloud credentials?
New SpyCloud research says infostealers are targeting tokens, session data and credentials from Claude Code, Codex, Cursor and GitHub Copilot.
More than 130,000 WardenStealer infections recovered since August.
AI access is valuable.
And attackers know it.
Are you protecting your AI credentials like your cloud credentials?
2
1
4
219