Stashbase: Credential Isolation and HTTP-Level Access Control for AI Agents
radim11 · reddit · 2026-08-11
Passing credentials like API keys via environment variables poses significant security risks for AI coding agents, including potential leaks or misuse. A team is building Stashbase to provide a more secure credential management approach.
Core Mechanics:
- Just-in-time Injection: Credentials are injected only at request time, ensuring the agent never sees the raw secret.
- Destination Restriction: Credentials can be restricted to approved destinations (e.g., a GitHub token only works for GitHub).
- HTTP Rules: Adds granular control over HTTP methods and paths, allowing actions like reading issues or creating PRs while blocking repository deletion.
This approach aims to reduce the blast radius and enforce policy boundaries for agents executing commands or using MCP tools.
More from coding & agent
- Team Tests AI Coding Workflow: Claude Code Writes, Codex Verifies — 2C_ornot2C · 2026-08-12
- Using AI Agents with No-Code Builders: Great for First Drafts, Bad at Specifics — Nice-Society-4074 · 2026-08-12
- Firecrawl Becomes Keyless Web Search Provider for opencode — devdigest · 2026-08-12
- Claude Task Viewer: Open-Source Kanban for Monitoring Claude Code — tom_doerr · 2026-08-12
- Geometric-Aware CAD Agent: Modify Single Dimensions Without Breaking the Model — jakedahn · 2026-08-12
- Stripe Demo Day: Claude Agent Autonomously Books Anniversary Trip — jeff_weinstein · 2026-08-12