Software Engineering Radio - the podcast for professional software developers

SE Radio 722: Dwayne McDaniel on the Engineering Challenges of Secrets Management

Software Engineering Radio - the podcast for professional software developers

Show Notes

Dwayne McDaniel, developer advocate at GitGuardian.com, joins host Priyanka Raghavan to talk about the engineering challenges of secrets management. They explore what "secrets" really are in modern systems—far beyond passwords—including API keys, tokens, certificates, and machine identities, and how "secret sprawl" emerges across the SDLC. Drawing on reports from GitGuardian and Verizon, they discuss the growing scale of secret leaks and why credential abuse and phishing remain dominant attack vectors. They examine common leak points—from code repos and logs to CI/CD pipelines, containers, and SaaS integrations—and how cloud, DevOps, and AI tooling are amplifying risks. Priyanka quizzes Dwayne about recent supply chain attacks from pyPi and trivy ecosystems, highlighting recurring root causes like poor access control, long-lived credentials, and weak security hygiene. Finally, they consider detection, response, and modern solutions—short-lived credentials, secret scanning, and identity-based approaches like OWASP NHIR and SPIFFE/SPIRE—ending with practical advice for engineers to reduce blast radius and design for secure secret lifecycle management.

More from Software Engineering Radio - the podcast for professional software developers

Oct 21, 2026

Sowjanya Pandruju, Cloud Application Architect with Amazon Web Services, Vice Chair of the IEEE Computer Society Madison Section, and Chair of the IEEE Women in Engineering (WIE) Madison Section (Region 4), speaks with SE Radio host Gavin Henry about managing agent state. Sowjanya discusses what agents are and are not, what agent state is, the role an LLM actually plays, why agents need state, the different types of state, where to store agent state, how multi-agents change things, and the solutions to the various challenges created by managing agent state. Brought to you by IEEE Computer Society and IEEE Software magazine.

Oct 14, 2026

Tim Varelmann, the founder of Bluebird Optimization, which helps companies automate complex decision-making, speaks with host Sriram Panyam about mathematical optimization. The episode begins by differentiating optimization from what software engineers usually mean by the word. Making something faster or smaller is improvement, whereas optimization means finding the provably best solution after which no further improvement is possible unless the problem's parameters change. The conversation examines the difference between simulation and optimization, where optimization is already running, optimization and AI, key software engineering principles, and how you can get started with mathematical optimization.

Oct 7, 2026

Sahil Walia, a senior technical architect at Snowflake, joins host Robert Blumen for a conversation about schema migration and data migration. Together, they discuss the basics of schema: do all data sets have schema?; what drives schema change?; are data migration and schema migration the same thing? Must they happen at the same time? They then talk about the challenges and failure modes of schema migration, including challenges at scale, migrating without downtime, the concept of "safety" in data migrations, and safety patterns for data migration - double writes, read repair, replication, ending on the Apache Iceberg case study.

Sep 30, 2026

Raju Dandigam speaks with host Amey Ambade about building robust AI agents for production. Raju recommends treating an agent as a software subsystem rather than a standalone model call. That means designing decision contracts and tool boundaries, choosing between predictable workflows and multi-agent orchestration, and managing the runtime, state, and streaming that make agents durable. A recurring theme is that the model should not own the system: the right architecture is usually the simplest one that meets the product need while preserving reliability and control, with the language model placed inside a controlled runtime that settles authentication, policy, data freshness, and idempotency before it is ever asked to reason. They focus largely on how teams can be sure that an agent works and how to debug it when it does not. The episode covers behavioral testing against contracts, golden scenarios, and observability that captures the full execution path rather than flat logs, which is the gap behind agent-inspect and its readable execution trees. Raju and Amey close on operating agents in production: measuring cost and latency per run, knowing when a simpler model or no AI path is the right call, and treating prompts, schemas, tools, and evaluation sets as owned, versioned artifacts. Brought to you by IEEE Computer Society and IEEE Software magazine.

Sep 23, 2026

Erin Catto of Kintsugiyama, veteran video game developer who worked on the Tomb Raider series at Crystal Dynamics and later contributed to Diablo III, Overwatch, and other franchises at Blizzard, discusses video game physics engines with host Jason Davey. Erin created the popular open-source Box2D library used in titles including Angry Birds and Noita, and he released Box3D in 2026, bringing the much-loved physics engine to the third dimension. Underpinning everything from platformers and racing games to industrial robotics simulations, modern physics engines present a host of interesting engineering challenges, including the need to balance accuracy, stability, determinism, and performance. Catto describes the core concepts, the various trade-offs and factors that influence the design of these systems, and how they fit into the broader software architecture of a video game.

See all episodes →