OpenCode, Railway, and Northflank warn of secret exposure

Recent security incidents at platforms like OpenCode, Railway, and Northflank demonstrate that third-party services storing API keys and environment variables are vulnerable to internal breaches. The author argues that because platforms must decrypt secrets to inject them into running workloads, an attacker inside the vendor can access them as well. The article recommends practical defenses such as timing secret rotation, capping provider spending, planting tripwires, and minimizing the static storage of credentials. Open article →