9,308 leaked AWS keys still work | The Visor

What We're Watching

Three current stories for teams building and testing software.

Researchers found 9,308 leaked AWS keys that still authenticate

Truffle Security rechecked 10,616 complete key pairs found in git history, CI logs, Docker images, and package registries. Eighty-eight percent still worked, including 768 corporate credentials with full administrative access.

Malware at compile timeWiz

Malicious Rust crates ran a backdoor during compilation

Attackers published infected versions of three Rust code libraries. The malware ran when a developer built an application using one of them, before the application ever launched.

Model output to PythonGitLab

A Xinference tool-call parser turned model output into Python code

Xinference used Python eval() while parsing Llama3 tool calls. An attacker could shape a prompt so the model returned a Python expression, which the server then executed. Versions before 2.7.0 are affected.

Our Take

The application's security boundary includes the machinery that builds and operates it.

An AWS key can change infrastructure without touching the product. Cargo build scripts run before deployment with access to developer machines and CI secrets. In Xinference, model output crossed into Python's eval() during tool-call parsing. A credential, dependency, or parser can carry as much authority as the application itself.

Source history, CI runners, dependency hooks, and AI orchestration belong in the same review as production code. They assemble application behavior and often hold the permissions that turn one bad input into code execution.

Updates from Casco

A new source-code review stage, plus a clearer view of the credentials Casco can test with.

Code Review Agent

Code review now feeds Casco's live exploit testing.

After Casco discovers an endpoint, the Code Review Agent can follow it into the source code behind that part of the application. This helps it spot risks that are visible in the implementation but easy to miss from the outside.

Those risks still go through Casco's normal deduplication, enrichment, and live exploit-validation flow. Confirmed results carry a “Code review” label in the dashboard, so teams can see where they came from.

Access & Credentials

Know which test account Casco will use in each tenant.

Say an application has Admin and Member roles in two customer tenants. Casco needs a test account for each of those four combinations. The new matrix lists the account assigned to each one and marks a missing account as “Vacant.”

The matrix is a read-only checklist above the existing credential list. It shows gaps before a test starts; accounts are still added and edited in the same place as before.

Casconaut Highlight

One small recommendation from the people behind Casco.

This issue's Casconaut

Sonia Kalwit

Chief of Staff

Currently recommending

Hermanos Gutiérrez

Beautiful, instrumental music that somehow makes you feel something without saying a word!

It feels intentional without demanding your attention. Perfect for winding down and letting time slow down.