Software Engineering Radio · 2026-05-27 · 52 min
Dwayne McDaniel , developer advocate at GitGuardian.com , joins host Priyanka Raghavan to talk about the engineering challenges of secrets management. They explore what "secrets" really are in modern systems - far beyond passwords - including API keys, tokens, certificates, and machine identities, and how "secret sprawl" emerges across the SDLC. Drawing on reports from GitGuardian and Verizon, they discuss the growing scale of secret leaks and why credential abuse and phishing remain dominant attack vectors. They examine common leak points - from code repos and logs to CI/CD pipelines, containers, and SaaS integrations - and how cloud, DevOps, and AI tooling are amplifying risks. Priyanka quizzes Dwayne about recent supply chain attacks from pyPi and trivy ecosystems, highlighting recurring root causes like poor access control, long-lived credentials, and weak security hygiene. Finally, they consider detection, response, and modern solutions - short-lived credentials, secret scanning, and identity-based approaches like OWASP NHIR and SPIFFE/SPIRE - ending with practical advice for engineers to reduce blast radius and design for secure secret lifecycle management.
SE Radio 726: Scott Kingsley on the Swagger Ecosystem65 / 100SE Radio 725: Danny Yang and Sam Goldman on the Pyrefly Type CheckerSE Radio 724: Jure Leskovec on Relational Graph and Foundational ModelsSE Radio 723: Dave Airlie on Linux Kernel MaintenanceSE Radio 721: Rob Moffat on Risk-First Software Development