GitGuardian Power for Amazon Kiro: Secrets Detection Built Into the Agent

<h2> No jailbreak. No exploit. No alert fired. Just a conversation. </h2> <p>In September 2025, a Chinese state-sponsored threat group ran a cyberattack against 30 organizations

<h3> The "Ghost" in the Codebase </h3> <p>We’ve all been there. You’re running a security audit on an old repository, and your scanner flags 45 "Potential Secrets." You spend the

<p>Every developer has done it. You paste an AWS key into a Jira ticket, a GitHub issue, or a Notion doc — and five seconds later you realize what you just did.</p> <p>By then,

<p>It starts with a misconfigured S3 bucket.</p> <p>Not a zero-day. Not a nation-state exploit. Just a forgotten public bucket — the kind that shows up in every cloud audit and

<h2> The Setup </h2> <p>MCP (Model Context Protocol) lets AI agents call external tools. Instead of just reading files and running bash, the agent gets structured access to APIs,

<p>On March 31, 2026, Anthropic accidentally shipped the entire source code of Claude Code — its flagship AI coding agent — inside a routine npm update. No hack. No reverse

<p>In January and February 2026, security researchers filed <a href="https://www.heyuan110.com/posts/ai/2026-03-10-mcp-security-2026/" rel="noopener noreferrer">30 CVEs against

<h1> Why Your AI Coding Agent Should Never See Your .env </h1> <blockquote> <p>Your AI agent uses your API keys. It NEVER sees them. Not in context. Not in logs. Not in chat. Not