Your automation tools need secrets to work, so keys get pasted into code, configs, and CI wherever they run fastest. Central storage and rotation fix it, but only if you build them.
Thắng Đoàn•Security
Trust engineering for AI systems: prompt injection, agent permissions, secrets, supply chain.
Thắng Đoàn•Your feature dies in review because standards like OWASP Top 10 and ASVS were treated as final gates, not design inputs.
Thắng Đoàn•Checklists patch known holes. Threat modeling finds the holes you never listed, by asking four simple questions about your system.
Thắng Đoàn•Zero trust verifies a human at login. Agents act fast, unpredictably, and continuously, and your access model has no answer for them.
Thắng Đoàn•Agents need credentials to act, but agents holding secrets is the new attack surface. Proxy-brokering access keeps keys out of reach.
Thắng Đoàn•AI tripled open-source project volume since 2023. Your software still trusts that pool blindly, and attackers inherit a bigger, denser target.
Thắng Đoàn•AI agents with tool access turn prompt injection into real breaches, and one runaway agent cost $50,000. Identity, least privilege, and runtime limits are your levers.
Thắng Đoàn•Prompt injection tops the OWASP LLM risk list yet barely shows in incident records, because the attack lives where scanners cannot look.
Thắng Đoàn•One service account with broad credentials turns your agent into an over-privileged insider that a single prompt can talk into anything.
Thắng Đoàn•