AIWHYS

Topics

key rotation

2 synchronized stories carry this tag.

ReliabilityIncident

LiteLLM rotates image trust after the 1.107.0 supply-chain compromise

Attackers used exposed and stolen credentials to publish malicious LiteLLM 1.107.0 wheels and official container tags on 21 October. The signed 1.106.4 recovery release uses the rotated cosign key, repairs a startup ImportError when the remote cost map is unreachable and removes image-scanner false positives tied to the emSign root and unused packages.

Why it matters: The incident exposed model-provider and infrastructure secrets before applications imported LiteLLM. Version 1.106.4 is now the clean operational floor for the supported 1.106 line, but neither a new signing key nor quieter scanners revoke credentials stolen…

Read storyOriginal source · docs.litellm.ai
ReliabilityShipped

GitHub blocks Anthropic API keys at push by default

GitHub secret scanning now detects Anthropic service and user API keys and includes both detectors in push protection by default. Repositories with secret scanning enabled, including free public repositories, automatically block commits containing these key types.

Why it matters: Model credentials can authorize costly or sensitive API use. Blocking supported Anthropic keys before they enter Git history reduces an immediate leakage path, though it does not find every credential or replace rotation after exposure.

Read storyOriginal source · github.blog