The briefingSecurity
Loading Ashlr Brief
In about a day, Phantom Secrets merged fixes so a locked vault, a symlink swap or a dependency notice produces a clear answer instead of an empty one.
Between October 16 and 17, 2026, Phantom Secrets merged more than twenty pull requests. This round-up covers the ones with the clearest effect. All descriptions are Ashlr's own.
A locked vault used to look empty. One pull request describes calling every one of the 54 tools over the agent protocol in several states, 324 calls in all, and finding that some tools answered "nothing expiring" when the vault was simply locked. The fix refuses with a clear message that names the fix. A follow-up applies the same rule to the command line, and the doctor now reports a missing dotenv file.
"Init" no longer overwrites a hand-written example file. The description says it used to replace a committed .env.example with a generated stub, and that on one real project this removed about 600 documented lines. Now the file is left unchanged, and the command points to a way to write a generated example elsewhere.
Dotenv files are read more carefully. A pull request says the old code checked for a symlink and then opened the file in a second step, so a file swapped in between could be followed. It now opens the file once without following a symlink and checks the opened file itself. A second change applies the same approach to the remaining dotenv reads.
There is a new dry run for leak response. "phantom leaks plan" shows what automated response would do for active leak incidents. The description says it reads incidents only, writes nothing, uses no network and prints secret names, never values. A later pull request adds an on_leak setting with off, plan and revoke. It says live revoke stays disabled in shipped builds.
On October 17, RustSec published three notices that a library used on Linux was unmaintained, and the project's dependency check began failing on every pull request. The description says these are unmaintained notices, not vulnerabilities, and that no safe upgrade exists yet. The fix records the three IDs with that reason and leaves a larger library upgrade as follow-up.
If a tool can answer "nothing found" because it was locked out, an agent will believe it. Return an error that names the fix instead. The locked vault change is a good model.
Ask security vendors what their tools do when they cannot read something. An empty answer that looks like success is the worst result, because people act on it.
Pick one command in your own tooling. Make it fail on purpose, for example with a locked store or a missing file, and read exactly what it prints.
Ashlr tools connected to this story. Review their source and setup requirements.
Delegate supported API work through scoped placeholders and a local proxy, keeping real keys out of agent context.
Source material behind this briefing. Our practical implications are Ashlr’s interpretation.
This briefing was prepared with AI assistance from the linked sources. The analysis may include interpretation; consult the original sources for complete context. Cover artwork is illustrative.
Agents can read your .env file like any other file. Phantom Secrets swaps real keys for placeholders and adds the real one only when a request leaves.
Agents inherit whatever accounts happen to be logged in on your computer. Locus pins an agent to one identity, so acting as the wrong client becomes impossible.
On October 10, Phantom Secrets merged two fixes so a failed GitHub sign-in no longer leaves the dashboard or device approval stuck on an old account.
