{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Till Blog",
  "home_page_url": "https://till.ac/blog",
  "feed_url": "https://till.ac/feed.json",
  "description": "Externally sourced commentary on API key security and AI agent infrastructure.",
  "authors": [
    {
      "name": "Till",
      "url": "https://till.ac"
    }
  ],
  "items": [
    {
      "id": "https://till.ac/blog/strengthen-api-security-github-features",
      "url": "https://till.ac/blog/strengthen-api-security-github-features",
      "title": "Repository Secret Scanning Is a Backstop, Not a Vault",
      "date_published": "2026-06-07T12:00:00Z",
      "summary": "Use push protection, short-lived credentials, least privilege, and a practiced revocation path to keep API secrets out of source control.",
      "tags": [
        "API Security",
        "GitHub",
        "Secret Scanning",
        "Credentials",
        "Developer Workflow"
      ]
    },
    {
      "id": "https://till.ac/blog/serverless-api-strategy",
      "url": "https://till.ac/blog/serverless-api-strategy",
      "title": "Observability Is Part of the Serverless API Contract",
      "date_published": "2026-05-31T12:00:00Z",
      "summary": "A practical observability contract for tracing requests, diagnosing partial failures, and operating serverless APIs without logging secrets.",
      "tags": [
        "Serverless",
        "API Development",
        "Observability",
        "AWS Lambda",
        "Reliability"
      ]
    },
    {
      "id": "https://till.ac/blog/nist-guidelines-api-security-innovation",
      "url": "https://till.ac/blog/nist-guidelines-api-security-innovation",
      "title": "Applying NIST's SSDF to API-Backed AI Systems",
      "date_published": "2026-05-29T12:00:00Z",
      "summary": "A practical reading of NIST SP 800-218 for teams building software that depends on AI APIs and machine credentials.",
      "tags": [
        "Software Security",
        "NIST",
        "SSDF",
        "API Security",
        "AI Engineering"
      ]
    },
    {
      "id": "https://till.ac/blog/align-api-governance-ftc-ai-guidelines",
      "url": "https://till.ac/blog/align-api-governance-ftc-ai-guidelines",
      "title": "What FTC AI Enforcement Means for API Governance",
      "date_published": "2026-05-24T12:00:00Z",
      "summary": "AI governance should connect public claims and data promises to test evidence, provider configuration, and accountable operational records.",
      "tags": [
        "AI Governance",
        "FTC",
        "API Management",
        "Consumer Protection",
        "Accountability"
      ]
    },
    {
      "id": "https://till.ac/blog/human-factor-api-security-breaches",
      "url": "https://till.ac/blog/human-factor-api-security-breaches",
      "title": "Design API Credentials for Human Error",
      "date_published": "2026-05-17T12:00:00Z",
      "summary": "Training matters, but credential systems should limit the consequences of phishing, accidental disclosure, and routine operational mistakes.",
      "tags": [
        "API Security",
        "Credentials",
        "Phishing",
        "Security Culture",
        "Incident Response"
      ]
    },
    {
      "id": "https://till.ac/blog/aws-api-gateway-security-mirage",
      "url": "https://till.ac/blog/aws-api-gateway-security-mirage",
      "title": "An API Gateway Is a Security Control, Not a Security Boundary by Itself",
      "date_published": "2026-05-16T12:00:00Z",
      "summary": "How to turn API Gateway features into an enforceable security design through authorization, logging, configuration checks, and upstream controls.",
      "tags": [
        "API Security",
        "AWS",
        "API Gateway",
        "Observability",
        "Least Privilege"
      ]
    },
    {
      "id": "https://till.ac/blog/ai-coding-tools-api-governance",
      "url": "https://till.ac/blog/ai-coding-tools-api-governance",
      "title": "AI Coding Agents Need the Same API Controls as Every Other Workload",
      "date_published": "2026-05-13T12:00:00Z",
      "summary": "A practical governance model for AI coding agents that call external APIs, handle credentials, and propose production changes.",
      "tags": [
        "AI Coding",
        "API Governance",
        "Software Security",
        "Credentials",
        "Code Review"
      ]
    },
    {
      "id": "https://till.ac/blog/api-secrets-risk-infrastructure-code",
      "url": "https://till.ac/blog/api-secrets-risk-infrastructure-code",
      "title": "Keep API Secrets Out of Infrastructure-as-Code State",
      "date_published": "2026-05-10T12:00:00Z",
      "summary": "Redacting an Infrastructure-as-Code variable from terminal output does not necessarily keep its value out of plans or state.",
      "tags": [
        "Infrastructure as Code",
        "Terraform",
        "API Security",
        "Secrets Management",
        "DevOps"
      ]
    },
    {
      "id": "https://till.ac/blog/vendor-evaluation-cognitive-load-breaking-teams",
      "url": "https://till.ac/blog/vendor-evaluation-cognitive-load-breaking-teams",
      "title": "A Disciplined Evaluation Loop for AI API Providers",
      "date_published": "2026-05-03T12:00:00Z",
      "summary": "Replace demo-driven provider selection with documented use cases, repeatable tests, bounded trials, and explicit exit criteria.",
      "tags": [
        "Vendor Evaluation",
        "AI Governance",
        "Provider Selection",
        "Risk Management",
        "Technical Leadership"
      ]
    },
    {
      "id": "https://till.ac/blog/ai-coding-tools-creating-infrastructure-blind-spots",
      "url": "https://till.ac/blog/ai-coding-tools-creating-infrastructure-blind-spots",
      "title": "How to Operate the API Integrations AI Helps You Write",
      "date_published": "2026-05-02T12:00:00Z",
      "summary": "AI-assisted code still needs human review, failure-path tests, observable boundaries, and a runbook before it becomes production infrastructure.",
      "tags": [
        "AI Development",
        "Software Operations",
        "Code Review",
        "API Reliability",
        "Technical Leadership"
      ]
    },
    {
      "id": "https://till.ac/blog/kubernetes-1-30-secret-management-api-keys-harder-control",
      "url": "https://till.ac/blog/kubernetes-1-30-secret-management-api-keys-harder-control",
      "title": "A Safer Pattern for AI API Credentials in Kubernetes",
      "date_published": "2026-04-23T12:00:00Z",
      "summary": "Kubernetes Secrets are delivery objects, not a complete credential policy. Scope access at the cluster and upstream API layers.",
      "tags": [
        "Kubernetes",
        "API Security",
        "Secret Management",
        "Container Security",
        "AI Infrastructure"
      ]
    },
    {
      "id": "https://till.ac/blog/cicd-secret-scanning-misses-real-problem",
      "url": "https://till.ac/blog/cicd-secret-scanning-misses-real-problem",
      "title": "Secret Scanning Is a Leak Control, Not a Credential Lifecycle",
      "date_published": "2026-04-17T12:00:00Z",
      "summary": "Push protection can stop supported secrets from entering a repository, but it cannot define how production credentials are issued, scoped, observed, and retired.",
      "tags": [
        "API Security",
        "DevOps",
        "CI/CD Security",
        "Secret Scanning",
        "Credential Lifecycle"
      ]
    },
    {
      "id": "https://till.ac/blog/openai-dashboard-reveals-blind-spots",
      "url": "https://till.ac/blog/openai-dashboard-reveals-blind-spots",
      "title": "What an AI API Usage Dashboard Can—and Cannot—Control",
      "date_published": "2026-04-16T12:00:00Z",
      "summary": "Provider usage dashboards are essential for reconciliation, but workload-level limits still belong in the request path.",
      "tags": [
        "API Transparency",
        "AI Billing",
        "OpenAI",
        "Usage Analytics",
        "Cost Controls"
      ]
    },
    {
      "id": "https://till.ac/blog/hidden-costs-ineffective-api-key-governance",
      "url": "https://till.ac/blog/hidden-costs-ineffective-api-key-governance",
      "title": "An Operational Governance Checklist for AI API Credentials",
      "date_published": "2026-04-11T12:00:00Z",
      "summary": "API credential governance should produce an inventory, ownership, tested lifecycle actions, and evidence—not an abstract policy nobody operates.",
      "tags": [
        "API Security",
        "Key Management",
        "Governance",
        "AI Operations",
        "Incident Response"
      ]
    },
    {
      "id": "https://till.ac/blog/api-key-management-dilemma-security-usability",
      "url": "https://till.ac/blog/api-key-management-dilemma-security-usability",
      "title": "Secure API-Key Workflows Developers Will Actually Use",
      "date_published": "2026-04-06T12:00:00Z",
      "summary": "Credential controls work when the safe path is clear, fast, and observable. Here is how to reduce friction without weakening the boundary.",
      "tags": [
        "API Security",
        "Developer Experience",
        "Secrets Management",
        "AI Engineering",
        "Operations"
      ]
    },
    {
      "id": "https://till.ac/blog/growing-risks-api-key-sharing",
      "url": "https://till.ac/blog/growing-risks-api-key-sharing",
      "title": "Why Shared API Keys Destroy Workload Isolation",
      "date_published": "2026-03-31T12:00:00Z",
      "summary": "One provider key reused across many agents couples their security, operations, and incident response. Per-workload credentials restore useful boundaries.",
      "tags": [
        "API Security",
        "Key Management",
        "AI Agents",
        "Isolation",
        "Incident Response"
      ]
    },
    {
      "id": "https://till.ac/blog/rethink-api-key-expiry-policies",
      "url": "https://till.ac/blog/rethink-api-key-expiry-policies",
      "title": "Expiry Is a Layer, Not an API-Key Strategy",
      "date_published": "2026-03-27T12:00:00Z",
      "summary": "Credential expiry reduces the useful life of a leaked secret, but it must work with revocation, rotation, usage bounds, and provider-side controls.",
      "tags": [
        "API Security",
        "Key Management",
        "Credential Lifecycle",
        "Expiry",
        "AI Agents"
      ]
    },
    {
      "id": "https://till.ac/blog/500-calls-or-bust-why-activation-limits-matter",
      "url": "https://till.ac/blog/500-calls-or-bust-why-activation-limits-matter",
      "title": "Call Ceilings for AI Workloads: What They Do and What They Don't",
      "date_published": "2026-03-18T12:00:00Z",
      "summary": "A call ceiling can bound one dimension of an AI workload's exposure, but it belongs alongside provider controls, expiry, monitoring, and revocation.",
      "tags": [
        "API Security",
        "AI Agents",
        "Scoped Keys",
        "Activation Limits",
        "Resource Controls"
      ]
    }
  ]
}