A Python secret broker with a SQLite audit trail, so your coding agent can't quietly leak keys
A coding agent read passwords out of 1Password and committed them to an open repo. Here's a broker-plus-audit-log pattern you can rebuild instead of trusting the agent to behave.