data exfiltration

Your API Client Is a Credential Vault: Audit It

A developer opens an HTTP client on their Mac. Nothing else. No clicks, no consent dialogs, no "enable AI features" checkbox. The next day, their coding agent...