Bhawik BhagatA friendly PSA to every engineer spinning up AI agents right now:
That API key hardcoded into the script?
Someone said they'd move it to a secrets manager later.
It's been 8 months.
It's still there.
It has access to prod.
Nobody knows what it's touched.
AI agents are getting handed unchecked access with zero oversight.
No rotation. No expiry. No audit trail. No least privilege.
∆† яɪ¢κʏ †∆