Dev Machine Guard Now Inventories Where Developer Credentials Live

What it is

StepSecurity's Dev Machine Guard adds a Credentials page to its dashboard that inventories developer-credential sources across a fleet. It covers thirteen source types across five categories — Cloud, Source control, Package registries, Containers, and Infrastructure — at their supported default and relocated locations. The framing: attackers already have this list (hardcoded path enumerations in the TeamPCP/xinference and hijacked Bitwarden CLI payloads); defenders historically did not.

How it works

The page aggregates by credential source across the whole fleet, not per-machine. Each row shows: the source, how many devices hold it, how many hold plaintext material, how many credential files were found (Locations), and how many individual credentials those files contain (Entries). Filter by category, search by source, or export as CSV. Ordering by fleet spread is deliberate — a source on 11 of 12 machines is a fleet-wide problem; the same on 2 is a two-developer conversation.

Preconditions / Affected

The exposure it surfaces is inherent to how dev tools work, not misconfiguration: most tools (Docker, npm, GitHub CLI, Vault tokens) store credentials in directly-readable form so they can authenticate without prompting. Anything running as the developer's account — install scripts, IDE extensions, AI agents with shell access — can read them. SSH private keys are the main Protected case because they support passphrase/hardware encryption, though many are created without one.

What to do

For rotation planning, start from Entries (how much material to investigate); Devices tells you how many machines to visit. Treat everything listed as plaintext on a compromised machine as potentially exposed. The page positions install-time controls (package configs) as the cheaper fix — stopping hostile code from running beside the files rather than protecting the files themselves. SSH keys are where a concrete hygiene action (adding a passphrase) is most readily available today.

Caveats

Read these before acting on the numbers:

• Coverage is partial. Keychains, credential helpers, environment variables, browser stores, and password managers are all outside the inventory. Absence of a finding is not absence of credentials.
• Entries are counted as found — not deduplicated across devices and not validated against the provider. The same material stored twice counts twice; expired or incomplete entries still count.
• Findings reflect each device's most recent scan only and show where material was found, not whether a credential is still active or valid.
• Where Entries exceed Locations, some files hold several credentials (normal for multi-profile AWS credentials or a multi-host .netrc); where Locations exceed Devices, some machines hold multiple files (normal for SSH keys).