News World

Artificial Intelligence
The security reflex October 20, 2026 2 minutes

The security reflex

The security reflex

A deleted key stays in the history
A deleted key stays in the history. Removing it from the file does not remove it from past versions of the repository; only revoking it counts. Key removed from the file. new version saved. Repository history. keeps the old version. Key still readable. if the repository is public. Revoke with the provider. then a new key. Key removed from the file → Repository history (does not erase). Repository history → Key still readable (exposes). Revoke with the provider → Key still readable (makes useless).

Enlarge, download or share the infographic

Your agent had put an API key in the code, and you removed it: problem solved? No. Every saved version of your repository can still be viewed, and if the repository is public, the key can be read there forever; a stolen key then turns up on the bill, at the end of the month.

The right move. Revoke the key with the provider and create a new one, with a spending cap (our problem in issue 007). It is the only move that counts: deleting the file is not enough.

Reply to this email and tell us what you're building. Every reply gets read.

— News World AI

Read the full issue

Get the newsletter

Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.

Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.

News World AI

Geneva, Switzerland. Write to hello@newsworldai.xyz.