#Security

AI-coding-era security: secrets sprawl, vibe-coded RLS misconfigurations, prompt injection, and OWASP gaps the agent age makes worse.

9 articles

EngineeringMay 21, 2026 · 10 min read
Tene in GitHub Actions: secrets that survive AI-written workflows
Five ways AI-written GitHub Actions workflows leak API keys, and the local-vault pattern that closes the gap on any runner.
#devsecops#tutorial+2 more
Vibe CodingApr 30, 2026 · 10 min read
60% of vibe-coded apps leak API keys. Here's the missing step.
A Q1 2026 audit found 60%+ of vibe-coded apps ship API keys to public repos. Discipline isn't the fix — workflow is. The 60-second swap that ends it.
#tene#security+2 more
Vibe CodingApr 28, 2026 · 10 min read
MCP RCE: when an agent's tools become your attack surface
Every MCP server you install is a local process with access to your filesystem, network, and env. The threat model — and how to scope it before it costs you.
#claude-code#security+2 more
EngineeringApr 27, 2026 · 12 min read
The 12-word recovery key: how a local vault survives a forgotten password
How a 12-word BIP-39 mnemonic lets a local-first secret vault survive a forgotten master password — without a cloud account or email reset.
#cryptography#deep-dive+2 more
EngineeringApr 24, 2026 · 14 min read
Web basics for vibe coders: from localhost to production
AI wrote your code. Now how do you ship it to the internet? A plain-language tour of client/server, frontend/backend, database, deployment, and the security gap most AI tutorials skip.
#architecture#tutorial+2 more
Vibe CodingApr 23, 2026 · 5 min read
Your .env is not a secret. AI can read it.
Plaintext .env files are a liability in the AI coding era. Here is why the AI-agent threat model changes the math, and what to replace .env with.
#security#devsecops+1 more
Vibe CodingApr 23, 2026 · 5 min read
Claude Code + API keys: the safe workflow
A practical pattern for using Claude Code with real API keys without leaking them into the context window. Covers CLAUDE.md auto-generation, 'tene run --' subshell, and concrete Stripe / OpenAI examples.
#tene#claude-code+2 more
EngineeringApr 21, 2026 · 9 min read
XChaCha20-Poly1305 for developers: why it is the right choice for local secrets
A practical explanation of XChaCha20-Poly1305 and why tene picked it over AES-GCM for a local-first secret vault. No PhD required.
#cryptography#architecture+2 more
Vibe CodingApr 20, 2026 · 5 min read
Cursor + secret management in 2026
How to set up Cursor so API keys stay out of the AI context, using the .cursor/rules/tene.mdc file to teach the agent the safe pattern.
#tene#cursor+2 more