GitGuardian CEO: How Exposed API Keys & AI Agents Cause Security Breaches - Eric Fourrier
The Secure DisclosureShow Notes
What happens when two 25-year-old French engineers accidentally discover NASA's Slack admin API key on a public GitHub repository? That exact moment in 2017 launched GitGuardian. In this episode of The Secure Disclosure, GitGuardian CEO and co-founder Eric Fourrier sits down to share the wild origin story behind the company and how the battle against exposed secrets has shifted over the past decade. Eric breaks down how the threat landscape has evolved from public and private GitHub repositories straight to developer endpoints. With the rapid rise of AI coding agents and vibe coding, developers and non-engineers are inadvertently creating massive attack surfaces. Eric also reveals alarming statistics—including why developer laptops contain 50 times more valid secrets than GitHub repos, with 45% placed by non-deterministic AI agents.
More from The Secure Disclosure
AI coding agents ship code at record speed, and ship vulnerabilities just as fast. Edouard Viot, Co-founder and CTO at Symbiotic Security, explains why scanning in CI is already too late, how AI harnesses and system prompts build real-time guardrails, whether deterministic SAST is dead, and why malicious skills and plugins are the next big attack surface.Edouard Viot is the Co-founder and CTO at Symbiotic Security. Symbiotic Security builds end-to-end security for AI-assisted software development, securing code as it is generated inside coding agents rather than after the fact. Learn more at https://symbioticsec.aiThis episode is sponsored by Aikido Security, the no-nonsense software security platform. Start for free at https://aikido.dev
Phishing remains cybercrime's primary entry point, but outdated templates and punitive culture fail to stop AI-driven social engineering. In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Simon Bauwens, co-founder and CEO of Outkept. Simon explains why spotting phishing is a perishable reflex rather than a learned skill, how MFA fatigue leaves organizations vulnerable, and why Outkeep pays a crowdsourced community of ethical phishers based on simulation click rates. Finally, they explore building positive security cultures and play our signature Would You Rather challenge.
We are handing non-deterministic AI agents static API keys, then acting surprised when production databases get wiped.
As autonomous AI agents execute database queries and trigger APIs at machine speed, static permission models are collapsing. In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with David Mytton, CEO of Arcjet, to explore the shift from traditional network firewalls to application-native runtime security.David shares insights on managing non-deterministic non-human identities, mitigating prompt injection risks, and why granular authorization is essential for agentic workflows. He also debunks common myths surrounding data center water and energy consumption from his sustainable computing research, before facing a chaotic round of Would You Rather.
Is AI wiping out entry-level cybersecurity jobs? On this episode of The Secure Disclosure, host Mackenzie Jackson sits down with veteran and advisory CISO Michael Farnum. They dive into why teams must presume exploitability, how newcomers can break into security using home labs instead of just college degrees, and why conference accessibility matters.