Field notes

What we find, and what it means

Notes from the work: findings we keep seeing, fixes that hold up, and the reasoning behind how this product decides what counts as a risk.

1 article matching

Tagged incident-response · clear

How to Find Secrets Already Committed to a Git Repository (and What to Do at 2 A.M.)

Deleting the file does nothing — the secret lives in history, clones, forks and caches. The search commands, the rotate-first order of operations, and how to prove the old credential is actually dead.

Aug 24, 20262 min read

Code Security

Talk to us.

Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.

01You writePlain form, no qualifying call, no obligation. The marketing checkbox is optional and unticked.

02A person reads itMessages land with the team, not a queue-bot. Nothing is auto-replied.

03You get an answerTo the address you gave — including “this product is not the right fit”, when that is the honest answer.

Prefer email?

privacy@webcuris.com

Reporting a vulnerability?

Read the disclosure policy first — it tells you what is in scope and what to expect.