# Credential exposure (https://jackin.tailrocks.com/research/platform/security/credential-exposure/)



This category organizes the jackin❯ research on credential exposure. Choose a page by the question you need to answer.

## Browse [#browse]

<Card title="Container Credential Exposure — Beyond Env Injection" href="/research/platform/security/credential-exposure/container-credential-exposure/">
  Maps credential exposure paths beyond environment injection and compares controls at container and host boundaries.
</Card>

<Card title="Credential Source Pattern — Design" href="/research/platform/security/credential-exposure/credential-source-pattern/">
  Defines a credential-source abstraction for resolving secrets without embedding provider-specific behavior in consumers.
</Card>

<Card title="Host Bridge Design — Flows, Threat Model, and Open Questions" href="/research/platform/security/credential-exposure/host-bridge-design/">
  Defines host-bridge request flows, trust boundaries, authorization controls, and unresolved security questions.
</Card>

<Card title="jackin-exec: Design Rationale and Implementation Record" href="/research/platform/security/credential-exposure/jackin-exec-design/">
  Records the threat model and architecture for releasing credentials only to an authorized on-demand command.
</Card>

<Card title="Registry Configurations — Design" href="/research/platform/security/credential-exposure/registry-configurations-design/">
  Designs secure registry configuration delivery across host, capsule, runtime, and credential-source boundaries.
</Card>

## How to read [#how-to-read]

Start with the page closest to your current question. Follow its related-work links for evidence in adjacent categories and its Roadmap links for implementation commitments.