https://vacua.dev/tags/credentials/Recent content in Credentials on Brian FaustHugoen-USMon, 01 Jan 0001 00:00:00 +0000https://vacua.dev/a-short-lived-token-can-still-have-a-large-blast-radius/Thu, 01 Jan 2026 00:00:00 +0000https://vacua.dev/a-short-lived-token-can-still-have-a-large-blast-radius/<p>The release job has no stored cloud key. It asks GitHub for an identity token, exchanges that token for a five-minute production credential, deploys, and lets the credential expire.</p> <p>A compromised dependency runs in the same job. It can use the same identity request interface and deploy while the credential is live. Five minutes is short for an attacker waiting outside the build. It is generous for code which is already executing inside it.</p>