<p><a class= "_ymio1r31 _ypr0glyw _zcxs1o36 _mizu194a _1ah3dkaa _ra3xnqa1 _128mdkaa _1cvmnqa1 _4davt94y _4bfu1r31 _1hms8stv _ajmmnqa1 _vchhusvi _kqswh2mm _ect4ttxp _syaz13af _1a3b1r31 _4fpr8stv _5goinqa1 _f8pj13af _9oik1r31 _1bnxglyw _jf4cnqa1 _30l313af _1nrm1r31 _c2waglyw _1iohnqa1 _9h8h12zz _10531ra0 _1ien1ra0 _n0fx1ra0 _1vhv17z1" title= "https://trail.gitguardian.com/api/t/c/usr_XgQEQPgwFZ78282oE/tsk_CSQx5hsyFYHpAHx2r/enc_U2FsdGVkX19aR9lGtbabCxEhb9Yde_hsokM0Br2H8cO0MuhkXtGOlxqoSa2kzhx9AJEkM4SrYvH4PEzf842ZL9fm-omZUuEVXLdnzhA74ugphvs8lMXgwE63YENVZ9Ax" href= "https://trail.gitguardian.com/api/t/c/usr_XgQEQPgwFZ78282oE/tsk_CSQx5hsyFYHpAHx2r/enc_U2FsdGVkX19aR9lGtbabCxEhb9Yde_hsokM0Br2H8cO0MuhkXtGOlxqoSa2kzhx9AJEkM4SrYvH4PEzf842ZL9fm-omZUuEVXLdnzhA74ugphvs8lMXgwE63YENVZ9Ax" data-renderer-mark="true" data-is-router-link="false" data-testid= "link-with-safety">Dwayne McDaniel</a>, developer advocate at <a class= "_ymio1r31 _ypr0glyw _zcxs1o36 _mizu194a _1ah3dkaa _ra3xnqa1 _128mdkaa _1cvmnqa1 _4davt94y _4bfu1r31 _1hms8stv _ajmmnqa1 _vchhusvi _kqswh2mm _ect4ttxp _syaz13af _1a3b1r31 _4fpr8stv _5goinqa1 _f8pj13af _9oik1r31 _1bnxglyw _jf4cnqa1 _30l313af _1nrm1r31 _c2waglyw _1iohnqa1 _9h8h12zz _10531ra0 _1ien1ra0 _n0fx1ra0 _1vhv17z1" title="http://GitGuardian.com" href="http://gitguardian.com/" data-renderer-mark="true" data-is-router-link="false" data-testid= "link-with-safety">GitGuardian.com</a>, joins host Priyanka Raghavan to talk about the engineering challenges of <em data-renderer-mark="true">secrets management.</em> They explore what "secrets" really are in modern systems—far beyond passwords—including API keys, tokens, certificates, and machine identities, and how "secret sprawl" emerges across the SDLC. Drawing on reports from GitGuardian and Verizon, they discuss the growing scale of secret leaks and why credential abuse and phishing remain dominant attack vectors. They examine common leak points—from code repos and logs to CI/CD pipelines, containers, and SaaS integrations—and how cloud, DevOps, and AI tooling are amplifying risks. Priyanka quizzes Dwayne about recent supply chain attacks from pyPi and trivy ecosystems, highlighting recurring root causes like poor access control, long-lived credentials, and weak security hygiene. Finally, they consider detection, response, and modern solutions—short-lived credentials, secret scanning, and identity-based approaches like OWASP NHIR and SPIFFE/SPIRE—ending with practical advice for engineers to reduce blast radius and design for secure secret lifecycle management.</p>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

SE Radio 722: Dwayne McDaniel on the Engineering Challenges of Secrets Management

Software Engineering Radio - The Podcast for Professional Software Developers

AI Chapters

AI Insights

Reviews