Why this exists

AuthInjector was built inside a small web agency that runs AI coding agents all day. An agent that can run commands can print any credential in its reach, and over one summer it did — more than once, the last time straight through a guard written after the time before. Blocklists enumerate ways to print an environment, and that set is not enumerable.

So the keys left. They moved into one root-owned file read by a small service, and every outbound call from the agents now goes through it. The agents got simpler, not more complicated: the line that set the key was deleted and nothing replaced it. That service is AuthInjector.

It is a single static binary, a systemd socket and a public catalogue of services. It runs on the host beside the thing it protects, and it is the same install whether that host is a laptop, a build box or a fleet.

This website is built and run by Black Squid, a web design studio in Almonte, Ontario.