Nine Secrets, One Alias Boundary: The Credential Playbook Across Applications, APIs, and AI Agents
JWTs, API Keys, OAuth Tokens, and Six More Credential Types: What Changes When DevFortress Moves the Alias Boundary Underneath Them Introduction Nine different credential types - JWTs, API keys, OAuth tokens, session cookies, cloud IAM credentials, SSH keys, database credentials, webhook signing se
Posted on Oct 21 • Originally published at devfortress.net
Each credential type below has its own story of how a hardening checklist got skipped in practice.
JWTs - GitHub Copilot's CamoLeak vulnerability (CVE-2025-59145) let a prompt-injection payload exfiltrate private repository contents through Copilot's own image-proxy channel, using the session's existing JWT the entire time. The token itself was never cracked - it simply worked for whoever presented it.
API Keys - Toyota's T-Connect service exposed a hardcoded API key for roughly five years before discovery. GitGuardian found 12.8 million secrets exposed on public GitHub in 2023 alone, 91.6% of them still valid five or more days after detection.
Cloud IAM Credentials - Capital One's 2019 breach traced back to an SSRF attack that reached the EC2 instance metadata service and retrieved over-permissioned temporary IAM credentials.
SSH Keys - The same CircleCI breach cascaded into SSH keys: once the attacker reached a production process, the encryption keys extracted from it decrypted every category of secret CircleCI stored.
Database Credentials - LastPass's two-stage breach is the clearest case of a credential surviving capture: a stolen encrypted S3 key sat inert for four months until a second, unrelated breach supplied the decryption key needed to use it. LastPass agreed to a $24.45 million class-action settlement in late 2025.
Webhook Signing Secrets - These rarely make headlines on their own; they fail quietly, as one more string inside the same secrets-sprawl problem.
mTLS Client Certificates - Okta's AD/LDAP Delegated Authentication feature had a bcrypt truncation bug that let any password authenticate for usernames 52+ characters long - active for three months before discovery.
This guide walks through the known, documented abuse pattern for each credential type, shown as working vulnerable-vs-hardened code - and then what changes once the credential itself is aliased, so a captured value resolves to nothing usable rather than handing an attacker a working credential.
None of this replaces getting the fundamentals right. Those are first-line defenses and they still matter regardless of what sits underneath them. Aliasing is about what's left standing on the day one of them has a gap nobody's found yet.
This is a condensed version. The full post has the working vulnerable-vs-hardened code for all nine credential types, plus the actual devfortress-sdk implementation pattern for each.