The Keys Weren't Missing. My Access Was.

You have a credential somewhere that can only see a fraction of what you assume it can. I would bet on it.

Mine runs an automation stack that handles a chunk of my business without me watching it. Most days it commits code, files issues, patches broken builds, and reads secrets out of a vault to build things that need secrets. Boring, mostly. Boring is the entire point.

This week it went looking for two Stripe keys in the secrets manager, didn’t find them, and told me so. Confidently. In a pull request. In a GitHub issue. In this week’s log. In a comment inside actual production code. Four places, one wrong sentence, all written by something that had run a real command, read a real result, and taken it completely at face value.

The command was a simple list-projects call. It came back with exactly one project. The automation read that as “here is everything I can see” and quietly upgraded it to “here is everything that exists.” Those are different claims. The gap between them is precisely the size of whatever you’ve been denied access to, and nothing on screen tells you the gap is there.

Here’s the part that should have caught it and didn’t. A credential scoped to one project doesn’t say “you’re not allowed to look here.” It says “this project does not exist” - the exact message it would give for a project that genuinely never existed. Same words, same response, same everything. One tool, one answer, for two completely different situations, and telling them apart is homework it leaves for you.

So the automation did the reasonable thing with the information in front of it, which happened to be the wrong thing, because the information was incomplete in a way that looked complete. It’s a neat trap. The narrower the credential, the shorter the list it returns, and the shorter the list, the more it resembles a full and final inventory rather than a slice of one. Nobody reads a short, clean list and feels less sure. Most people feel more sure. Less clutter looks like less to hide.

I’ve done the human version of this for years, long before anything of mine ran unattended. You grep a codebase, find nothing, and the search quietly skipped a vendored folder you forgot existed. You query a read replica a few seconds behind and conclude a row was never written. You search your own Slack for a decision, find nothing, and announce it was never discussed - forgetting the one channel you were never added to. Every one of these hands back a clean, confident, empty result. None of them flag themselves as partial, because from where the tool is standing, they aren’t.

The fix isn’t “double check everything,” which is advice nobody actually follows, because it costs more up front than the mistake usually costs later. The fix is one narrower habit: before you report that something doesn’t exist, check what you were looking through, not just what you found. For a credential, that means one extra call before the first one - ask what the credential itself is, what it’s scoped to, what it’s actually allowed to touch - rather than jumping straight to asking it what’s out there. It takes one call and it answers the real question, which was never “does this exist” but “am I even positioned to know.”

The keys, for the record, were exactly where they were supposed to be. Sitting in a different project, behind a token that had never been granted access to it, working precisely as designed. The design was fine. Reading a clean “not found” as a verified absence was the actual mistake, and it is a far easier one to make again than the missing-keys story ever was.