https://till.ac/blogExternally sourced commentary on API key security and AI agent infrastructure.en-ushttps://till.ac/blog/strengthen-api-security-github-featureshttps://till.ac/blog/strengthen-api-security-github-featuresSun, 07 Jun 2026 12:00:00 GMTUse push protection, short-lived credentials, least privilege, and a practiced revocation path to keep API secrets out of source control. https://till.ac/blog/serverless-api-strategyhttps://till.ac/blog/serverless-api-strategySun, 31 May 2026 12:00:00 GMTA practical observability contract for tracing requests, diagnosing partial failures, and operating serverless APIs without logging secrets. https://till.ac/blog/nist-guidelines-api-security-innovationhttps://till.ac/blog/nist-guidelines-api-security-innovationFri, 29 May 2026 12:00:00 GMTA practical reading of NIST SP 800-218 for teams building software that depends on AI APIs and machine credentials. https://till.ac/blog/align-api-governance-ftc-ai-guidelineshttps://till.ac/blog/align-api-governance-ftc-ai-guidelinesSun, 24 May 2026 12:00:00 GMTAI governance should connect public claims and data promises to test evidence, provider configuration, and accountable operational records. https://till.ac/blog/human-factor-api-security-breacheshttps://till.ac/blog/human-factor-api-security-breachesSun, 17 May 2026 12:00:00 GMTTraining matters, but credential systems should limit the consequences of phishing, accidental disclosure, and routine operational mistakes. https://till.ac/blog/aws-api-gateway-security-miragehttps://till.ac/blog/aws-api-gateway-security-mirageSat, 16 May 2026 12:00:00 GMTHow to turn API Gateway features into an enforceable security design through authorization, logging, configuration checks, and upstream controls. https://till.ac/blog/ai-coding-tools-api-governancehttps://till.ac/blog/ai-coding-tools-api-governanceWed, 13 May 2026 12:00:00 GMTA practical governance model for AI coding agents that call external APIs, handle credentials, and propose production changes. https://till.ac/blog/api-secrets-risk-infrastructure-codehttps://till.ac/blog/api-secrets-risk-infrastructure-codeSun, 10 May 2026 12:00:00 GMTRedacting an Infrastructure-as-Code variable from terminal output does not necessarily keep its value out of plans or state. https://till.ac/blog/vendor-evaluation-cognitive-load-breaking-teamshttps://till.ac/blog/vendor-evaluation-cognitive-load-breaking-teamsSun, 03 May 2026 12:00:00 GMTReplace demo-driven provider selection with documented use cases, repeatable tests, bounded trials, and explicit exit criteria. https://till.ac/blog/ai-coding-tools-creating-infrastructure-blind-spotshttps://till.ac/blog/ai-coding-tools-creating-infrastructure-blind-spotsSat, 02 May 2026 12:00:00 GMTAI-assisted code still needs human review, failure-path tests, observable boundaries, and a runbook before it becomes production infrastructure. https://till.ac/blog/kubernetes-1-30-secret-management-api-keys-harder-controlhttps://till.ac/blog/kubernetes-1-30-secret-management-api-keys-harder-controlThu, 23 Apr 2026 12:00:00 GMTKubernetes Secrets are delivery objects, not a complete credential policy. Scope access at the cluster and upstream API layers. https://till.ac/blog/cicd-secret-scanning-misses-real-problemhttps://till.ac/blog/cicd-secret-scanning-misses-real-problemFri, 17 Apr 2026 12:00:00 GMTPush protection can stop supported secrets from entering a repository, but it cannot define how production credentials are issued, scoped, observed, and retired. https://till.ac/blog/openai-dashboard-reveals-blind-spotshttps://till.ac/blog/openai-dashboard-reveals-blind-spotsThu, 16 Apr 2026 12:00:00 GMTProvider usage dashboards are essential for reconciliation, but workload-level limits still belong in the request path. https://till.ac/blog/hidden-costs-ineffective-api-key-governancehttps://till.ac/blog/hidden-costs-ineffective-api-key-governanceSat, 11 Apr 2026 12:00:00 GMTAPI credential governance should produce an inventory, ownership, tested lifecycle actions, and evidence—not an abstract policy nobody operates. https://till.ac/blog/api-key-management-dilemma-security-usabilityhttps://till.ac/blog/api-key-management-dilemma-security-usabilityMon, 06 Apr 2026 12:00:00 GMTCredential controls work when the safe path is clear, fast, and observable. Here is how to reduce friction without weakening the boundary. https://till.ac/blog/growing-risks-api-key-sharinghttps://till.ac/blog/growing-risks-api-key-sharingTue, 31 Mar 2026 12:00:00 GMTOne provider key reused across many agents couples their security, operations, and incident response. Per-workload credentials restore useful boundaries. https://till.ac/blog/rethink-api-key-expiry-policieshttps://till.ac/blog/rethink-api-key-expiry-policiesFri, 27 Mar 2026 12:00:00 GMTCredential expiry reduces the useful life of a leaked secret, but it must work with revocation, rotation, usage bounds, and provider-side controls. https://till.ac/blog/500-calls-or-bust-why-activation-limits-matterhttps://till.ac/blog/500-calls-or-bust-why-activation-limits-matterWed, 18 Mar 2026 12:00:00 GMTA call ceiling can bound one dimension of an AI workload's exposure, but it belongs alongside provider controls, expiry, monitoring, and revocation.