Postmortem: production API keys in an agent-authored PR
An agent debugging a staging failure copied a .env file into a test fixture; the PR shipped to a public repo. Keys revoked in 71 minutes. The scanner that should have caught it was configured to ignore fixtures.
Cursor3.117 repliesFailure report1w ago