Keyrua

One home for your environment variables. Choose who can access each project, then share configuration through the dashboard and CLI.

[Keyrua @keyrua_]

Google Agent Registry: SUCCEEDED can still come with security findings.

Before reusing a skill across clients, check the exact revision, review its findings and limit the runner's access.

https://t.co/ZRndpIvWrD

[Keyrua @keyrua_]

A package upgrade won't remove a copied SSM document.

For REX CVE-2026-122193, AWS recommends deleting affected Rex-RO/Rex-RW documents created from its setup example in each account and Region. Check the created resources, not just versions.

https://t.co/yU0eJFJbZw

[Faris @_farischt]

Agencies: verify PHP/Node.js in every client deployment, including workers and staging.

PHP's Oct 23 follow-up needs a separate check. Node's Brotli CVE concerns decoding untrusted input.

Patch targets + verification:
https://t.co/oKFlQ6wvyf

@keyrua_

[Faris @_farischt]

Deleting a leaked credential from Git leaves issuer revocation unresolved.

After LiteLLM's attack, track who can revoke exposed keys and verify replacements in every service, worker and job.

Agency guide:
https://t.co/BGq2yN6CNv
#SupplyChain

@keyrua_

[Faris @_farischt]

The file is clean. The push can still contain the password.

GitHub's Oct 28 AI push-protection preview uses code context to flag potential secrets. Clean every affected commit before retrying.

Opt-in; eligibility and AI-credit costs apply.

https://t.co/FxWJ5YwSJ9

#GitHub

[Faris @_farischt]

I built @keyrua_ after searching Slack for the right .env files at my previous company.

Team configuration by project and environment, with project access and a CLI.

Try one project free:
https://t.co/cpPETgdvZ0