Home / Articles / The key is not the risk / Versions / v1.1.0
The key is not the risk: what changed in v1.1.0
From v1.0.0 (2026-10-21, 2a747f154) to v1.1.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 44 unchanged. About 0 words added and 95 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot kr-pellbridge.webp | images/ | Pellbridge's day through one question: would hiding the keys have stopped it? OfTwo of nine incidents, a gateway that injects credentials touches two, the readable bureau key and the ops-batch secret. The other seven are about what the agent may do: a payment, an email, an alert, a standing order, a trade record, advice.yes. | comparison
24 unchanged paragraphs, under In short {#in-short}, A good pattern {#pattern}, What are we worried about? {#worried}…
!shot kr-pattern.webp | images/ | Credential injection, and where the risk goes:injection: the agent holds no key, and the gateway adds it on the way out from a credential store, to public APIs and internal systems. A hidden instruction that makes the agent ask for the wrong payment still gets its key added.out. Our drawing of the pattern. | concept
7 unchanged paragraphs, under The questions, in order {#questions}
!shot kr-questions.webp | images/ | Five questions to ask before protecting a key:key, canfollowed an attacker reach the target with it; would we see it used; what can the key do; what can an injected agent do without it; what does the control cost. Thenby defence in depth. | concept
11 unchanged paragraphs, under What this does not claim {#limits}, Where this comes from {#sources}