Good post, thanks for sharing. I discovered CH around 2018, and I knew it would change the analytics space. I spent countless hours studying it on my own and promoting it at work (when it made sense). I also tried to land a job at companies using it, but nothing happened :(.
I still check the monthly changelog, even though I do quite different things at work these days.
How are you folks handling secrets in a simple way?
- sops , ansible vault and similar seems too weak given the agent is gonna read them at some point if you have the pass available.
- proxy injection seems too complicated and doesn’t cover all use cases.
Try not to: use AWS short-term credentials for anything there, federate with GitHub/GitLab job credentials where possible, etc. It’s easier and you never worry about rotation again.
If you can’t avoid it, use an automatically-rotated store and inject them as late as possible so an attacker needs to be able to get them out of a running process.
In all cases, look into restrictions: not just least privilege access but things like network restrictions so an attacker can’t just use the key on their own systems.
I recently finally fully moved all my projects away from .env (for local dev) to infisical, thinking it'd be the way to stop agents from (accidentally?) peeking at my secrets. while I'm still glad I made the move, it's clear that local agents are still moving around my local environment with sufficient privileges and autonomy to use infisical cli however it wants. my work isn't high stakes enough to matter much and I have rotation scripts on hand, but it's hard to see how to fully close the door against this type of risk at this point.
There's a solution for this in Infisical! It's called secrets brokering and is built into the Infisical CLI: The Infisical agent proxy. Using this, your agent can use secrets without ever being able to fetch them back since they are injected into upstream requests. You can use this for local coding agents like Claude Code or Codex, and also have a standalone proxy with a separate machine identity for longer running agents (slack agents, hermes, openclaw etc.) Check it out here:
It's not clear to me whether this is being done with genuinely good intentions, or if it's just a way to put barriers in front of open-source models. We'll see.
This is not my case. Today Claude code coded three features in my client saas just perfectly. Medium complex ones but perfectly from the plan, tests, linter and pr.
A good CLAUDE.md is enough. Skills for auxiliary tools like sentry, grafana…
reply