:quality(75))
The CosmicSting incident in June exposed weak spots in secret hygiene and access control. August 2024 was the follow-through — disciplined key rotation, practical 2FA, and removing long-lived credentials across the stack, from the Adobe Commerce (Magento) admin through to Git providers and CI/CD.
Keys and tokens
Automate rotation for API keys, webhooks and service accounts. Keep secrets in a managed vault rather than in repositories, and prefer short-lived tokens with explicit scopes to broad keys with no expiry. In CI, adopt OIDC-based federation where it is supported so runners request credentials at run time instead of holding them.
2FA people will actually live with
Enforce WebAuthn — hardware keys or platform authenticators — for privileged admin and developer accounts, and pair it with SSO so deprovisioning happens in one place. Where 2FA genuinely disrupts service-to-service automation, replace it with signed, short-lived tokens and a strong audit trail. What you do not do is carve out an exemption and let it become permanent.
The developer supply chain
Disable personal access tokens for automation. Restrict repository secrets to the minimum that works. Require code review on protected branches, and sign releases with Sigstore or GPG. Run software composition analysis and image scanning on every build, and generate SBOMs so that when an advisory lands you can answer "are we affected?" in minutes rather than days.
Recommended steps
Automate secret rotation; migrate secrets to a vault; remove credentials from code and config.
Adopt OIDC for CI/CD where available; otherwise use scoped tokens with short TTLs.
Mandate WebAuthn-based 2FA for admins and developers; enforce SSO with least-privilege roles.
Tighten repository controls: no PATs for bots, restricted secrets, required reviews, signed releases.
Continuously scan dependencies and container images; publish SBOMs with each release.
None of this stops a credential leaking. It decides how much that leak is worth when it happens — and the earlier you make it routine, the calmer peak season gets.