The Forge — Armory Forge Systems — Signet Article #025
Yesterday, we found one of our own credentials sitting in a file we'd committed to a repository. A live key. In a codebase. It had been there for a while, quietly, because the repo was private and nobody had looked.
We fixed it the same day. Then we kept going — because finding one leak makes you wonder what else is hiding.
This is the checklist that followed. It took us about a day, it cost almost nothing, and any small business can do the same.
The Find
It started with a cleanup. We were moving credentials out of scattered config files and into a proper vault — the kind of chore every company keeps meaning to do. And during the move, we found it: a config file with a live shared secret, tracked in git, pushed to the repo weeks earlier.
The repo was private. That's the trap — private feels safe. But a committed secret doesn't stay in one place. It rides along in forks, in clones on laptops, in CI logs, in backups, in the hands of anyone who ever had access. The rule we now live by: if a secret ever touches a repository, assume it's compromised and rotate it. No exceptions, no "it was only private."
The bots don't care how private you think you are. Automated scanners crawl public code around the clock looking for exactly these files — configs, .env files, connection strings — and one copy anywhere public is all they need. Most attacks on small businesses don't start with a genius exploit. They start with a credential that was already lying around.
Why Small Businesses Are the Target
Not because you're interesting. Because you're soft.
Big companies have security teams, budgets, and compliance deadlines forcing them to patch. A small business has an owner who's trying to run payroll and answer email at the same time. The attacker isn't picking a fight with a bank — they're scanning for the easiest door on the street, and the small business with a spreadsheet of passwords is the easiest door.
The good news: you don't need a security team to stop being the easiest door. You need a checklist and one honest afternoon.
The Hardening Checklist
Here's exactly what we did, in order:
- Get the secrets out of the repo. Every credential moved to a vault (we use AWS Secrets Manager) with access controls and rotation. The file in git history was scrubbed and replaced with placeholders. The old key? Rotated the moment we found it. From now on, credentials live in one locked place — not in config files, not in code, not in a shared drive with the company name on it.
- Kill password logins. Our machines are keys-only SSH now. No password will ever get you in, which means no brute-force attack on a weak password will either.
- Add the tripwire. We installed fail2ban — a small watchman that watches the login logs and bans the IPs that hammer at the door. Keys-only already blocks the brute force; this makes the noise stop too.
- Close the ports. Firewall active, default deny, only port 22 open. If you don't need a door, it doesn't exist. Most small businesses have a half-dozen services exposed that nobody remembers why they opened.
- Patch the boring stuff. Five pending updates, including the bootloader. The updates that fix known vulnerabilities aren't glamorous, but they're the ones the scanners check for. Patch, reboot, move on.
- Fix the routing. While auditing, we found a database sitting in a network path that could theoretically reach the internet. It wasn't publicly reachable — but the routing was wrong, and wrong routing is one misconfiguration away from a real exposure. We moved it to a private network where it belongs.
- Back up the backups. Retention bumped from one day to seven — cheap insurance, and it makes the difference between "annoying Tuesday" and "we lost everything."
- Turn on the alarm. We triaged the security findings on our infrastructure — about fifty of them — and sorted them into noise, quick wins, and real fixes. Noise gets suppressed so it stops wasting attention. Real fixes get scheduled. Now the alarm only rings when something actually matters.
The Honest Catch
None of this makes us unhackable. Nothing does. Security isn't a state you reach — it's a practice you keep. The goal isn't to be impenetrable; it's to be the hard target, the house with the lights on and the dog, the one the scanner skips because the next door is easier.
And the maintenance is real. New code means new secrets to protect. New machines mean new configs to lock. That's why we didn't stop at a checklist — we built a system that watches for us. We run our own security agent on our own infrastructure, monitoring, triaging, and flagging the findings so a human only gets involved when it matters. We call it Bastion, and we run it on ourselves first. We'd rather eat our own cooking before we serve it to anyone else.
Why This Matters for Your Company
You don't need an IT department to stop being an easy target. You need one honest afternoon, a checklist, and somebody who keeps the practice going — because the threat landscape doesn't take weekends off, and neither does the scanner looking for your credentials.
The Closing Thought
Steel doesn't get strong once in the forge. It gets heated, hammered, quenched, and tested — then it goes back in the fire. Security is the same. You'll never finish. But you can absolutely get to the point where the bots move on to an easier door.
And that's the whole game: not being the easiest door on the street.
Want to know what's actually exposed in your business? The Armorer can walk you through it — no pressure, just answers.
