# secret storage Published articles for secret storage. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Sandboxed AI bots: give capabilities, not credentials DevFeed: [Sandboxed AI bots: give capabilities, not credentials]() Original publisher: [Read original article]() Author: Alex Petric Published: 2026-04-23T00:00:00Z Content type: tutorial Language: en Sources: [Windmill Blog]() Topics: [Security](), [Discord](), [Discord bot](), [stripe](), [implementation](), [WebSocket](), [HashiCorp Vault]() Tags: [agent](), [ai](), [ai-bots](), [ai-discord-websocket-triggers](), [api-keys](), [credentials](), [discord](), [secret-storage](), [secrets](), [security](), [ssh](), [stripe](), [websocket](), [websocket-triggers]() ### AI overview This tutorial shows how to build a Discord bot that answers billing questions through Stripe while keeping API keys hidden from an AI agent. Windmill tools retrieve credentials at runtime from encrypted resource storage, and the agent receives only tool capabilities. The sandbox also provides process, filesystem, CPU, memory, and optional network isolation. ### Source excerpt How do I build an AI Discord bot that accesses Stripe without leaking API keys? Use Windmill sandboxed tools to give the AI capabilities, not credentials. ## A bit more on Twitter/X's new encrypted messaging DevFeed: [A bit more on Twitter/X's new encrypted messaging]() Original publisher: [Read original article]() Author: Matthew Green Published: 2025-06-09T18:22:31Z Content type: article Language: en Sources: [Matthew Green]() Topics: [End-to-End Encryption](), [X (Twitter)](), [Encryption](), [Security](), [vulnerability](), [public key](), [Ratchet](), [Server](), [passwords](), [Meta]() Tags: [e2e](), [encryption](), [instagram](), [messaging](), [messenger](), [protocol](), [protocols](), [public-key](), [secret-storage](), [security](), [signal](), [technology](), [vulnerability]() ### AI overview This article examines XChat, X's end-to-end encrypted messaging protocol, focusing on its lack of forward secrecy and its server-side storage of user private keys. It explains the Juicebox key-storage design and argues that the security of the system depends heavily on its deployment and server protections. ### Source excerpt Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about Twitter (uh, X)'s new end-to-end encryption messaging protocol, which is now called XChat. The TL;DR of Matthew's post ... Continue reading A bit more on Twitter/X's new encrypted messaging -> ## GitHub branch protection bypass can expose protected credentials to workflows DevFeed: [GitHub branch protection bypass can expose protected credentials to workflows]() Original publisher: [Read original article]() Published: 2024-05-31T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub](), [Security](), [Vulnerabilities](), [code productivity]() Tags: [branch-protection-rules](), [github](), [github-branch-protections](), [new-branches](), [protected-branches](), [release-branches](), [release-workflow](), [secret-storage](), [secret-store](), [secrets](), [security](), [security-best-practices](), [use-of-github](), [vulnerability](), [workflows]() ### AI overview The article describes a GitHub branch protection behavior that can allow a newly created branch to become protected and gain access to environment secrets through workflows. The author argues that this behavior can enable credential exfiltration and create risks for projects using wildcard branch protection rules, particularly release workflows. ### Source excerpt Don't let the unexpected derail your projects. Read our guide on embracing uncertainty in software development and unlock new possibilities.