Have my keys been pwned? - API Edition by Jose Hernandez and Rod Soto

Jose Hernandez and Rod Soto explore the proliferation of compromised API keys and secrets across modern software delivery pipelines and public repositories. They investigate the root causes behind credential leakage, illustrating the gap between rapid software development cycles and centralized security governance.

The speakers walk through threat modeling for API-driven architectures at 03:05, examining how keys get inadvertently committed to source control or bundled inside compiled client binaries (05:54). At 09:05 and 11:58, they demonstrate automated secrets scanning tools, continuous detection methodologies, privilege scoping, and effective API key rotation workflows to neutralize exposed credentials before attackers can abuse them.

(AI summary — Gemini Flash)