#security

AI Hub

Scope Cloudflare API access to your AI agent's actual job. A practical guide to token permissions, resource limits, expiration, verification, and revocation.

Opinions Hub

Agent Master Key is a local vault for AI agent credentials. Here is the case for keys that stay scoped, revocable, and on your Mac.

How-Tos Hub

AI agents copy, hold, and leak API keys at machine speed — even the custodians get breached. The hygiene ladder that keeps your keys safe in 2026.

AI Hub

Kimi K3 is cheap enough that every agent will want a turn. How to try it through OpenRouter without writing a live API key into any agent config.

AI Hub

An always-on AI agent is a credential left running unattended. Here's how to host agents around the clock without turning a 3am mistake into a leaked key.

How-Tos Hub

Local-first and cloud credential storage have different blast radii. Here is how to compare safety, recovery, and operator control.

How-Tos Hub

Prompt injection can turn a web page into a credential leak. Here is how AI agents lose keys and what operators should lock down.

How-Tos Hub

A credential broker gives AI agents scoped, revocable access instead of handing every tool every key. Here is when you need one.

AI Hub

A fast audit for what your AI agents can touch: the questions to ask, the red flags to find, and how to shrink blast radius.

AI Hub

Connecting an MCP server hands your agent new powers — and new ways to leak your keys. The checklist to run before you plug a Model Context Protocol server