Blog
Notes from building Keyhouse: host breaches, key rotation, and giving AI agents access to APIs without handing them real keys. RSS feed.
How API keys leaked in 2026, and the habits that limit the damage
What went wrong at Vercel, OpenCode, Railway and LiteLLM, and ten habits that limit the damage when an API key leaks.
Introducing Keyhouse: proxy keys for your apps and your AI agents
Keyhouse gives your hosts and AI agents proxy keys instead of real API keys, so a host breach leaks nothing you'd rotate at OpenAI or Stripe.
How Keyhouse will work: proxy keys, a broker and scoped agent access
The planned design behind Keyhouse: proxy keys, the broker, envelope encryption, short-lived tokens, Cloudflare Workers and time-limited agent grants.
Railway's October 21 incident: what's confirmed and what to rotate first
What Railway has confirmed about its October 21, 2026 environment variable incident, what remains unconfirmed, and an order for rotating your keys.
