Blog
Threat models, architecture, post-mortems. No growth-hacking, no AI-generated filler. By Jesús E. Viera.
First-person walk through one paste: where the plaintext landed, why deleting the chat did not undo it, and the exact moment I stopped trusting human discipline to keep keys out of LLM context windows.
A practical, end-to-end guide: identity and scoping, never-reveal secrets, tool surface discipline, prompt injection, execution isolation, supply chain, audit, and a concrete incident runbook. Pillar post, ecosystem-neutral where possible.
HashiCorp Vault is the best secrets infrastructure the services era produced — and it's the wrong shape for agents. A technical walkthrough of where the fit breaks, why the natural retrofits leak, and how the two tools coexist.
A new infrastructure category is forming at the intersection of secrets management and AI agents. Naming it, mapping it, and separating it from the adjacent categories it gets confused with.
Why API keys end up in transcripts when you pair Claude Code with the usual secret-handling patterns, and what it takes to make the leak impossible instead of unlikely.
.env files solved a problem from 2011. The AI-agent threat model broke every assumption they were built on — here is what replaces them.
Cookies & analytics
The ClauLock product never phones home. The website uses Plausible (anonymous, no cookies) by default. With your consent we also load Google Analytics to understand which content lands. You can decline — the site works the same. Privacy policy .