Notes on credential governance, blast radius, rotation and incidents.https://subscope.work/https://subscope.work/blog/what-cfos-cant-see-about-api-spend/https://subscope.work/blog/what-cfos-cant-see-about-api-spend/API credential spend usually skips the AP process entirely — no PO, no contract review, no line item until the invoice posts. Here's what actual visibility looks like.Wed, 26 Aug 2026 00:00:00 GMTGuidehttps://subscope.work/blog/what-ctos-get-asked-about-api-keys/https://subscope.work/blog/what-ctos-get-asked-about-api-keys/SOC 2 prep, a customer's security questionnaire, a due-diligence data room — the question always arrives. Here's what a real answer looks like versus 'Steve knows where most of them are.'Mon, 24 Aug 2026 00:00:00 GMTGuidehttps://subscope.work/blog/what-pms-cant-see-about-the-vendor-stack/https://subscope.work/blog/what-pms-cant-see-about-the-vendor-stack/Cost, vendor sprawl, and ownership gaps live one layer below the roadmap — invisible until a bill, an audit, or a renewal forces the question. Here's what a product owner can actually see today.Fri, 21 Aug 2026 00:00:00 GMTGuidehttps://subscope.work/blog/openai-admin-key-detection/https://subscope.work/blog/openai-admin-key-detection/SubScope's one real scope-detection rule is a single prefix check on OpenAI keys. Here's exactly what it does, and why it's narrower than it sounds.Wed, 19 Aug 2026 00:00:00 GMTEngineeringhttps://subscope.work/blog/release-notes-cost-visibility/https://subscope.work/blog/release-notes-cost-visibility/A real changelog — multi-tenant governance foundation at launch, then a July-August push on cost visibility: daily cost history, Claude usage, spend-guardrail visibility, and three new AI providers.Fri, 14 Aug 2026 00:00:00 GMTChangeloghttps://subscope.work/blog/zombie-keys-vs-stale-keys/https://subscope.work/blog/zombie-keys-vs-stale-keys/How SubScope's 30/90/180-day rules actually work — and why 'unused' and 'stale' are different risks with different fixes.Tue, 28 Jul 2026 00:00:00 GMTPolicyhttps://subscope.work/blog/security-intel-keys-belong-in-the-register/https://subscope.work/blog/security-intel-keys-belong-in-the-register/Security-intelligence APIs are high-privilege and usually invisible to credential governance. That's backwards.Tue, 14 Jul 2026 00:00:00 GMTGuidehttps://subscope.work/blog/the-4200-loop/https://subscope.work/blog/the-4200-loop/How one unscoped OpenAI key became a four-figure invoice over a weekend, and how faster visibility would have changed the outcome.Tue, 30 Jun 2026 00:00:00 GMTIncident