Software supply chain malware increasingly targets secrets stored in plaintext on developer workstations. This post presents a practical open-source approach combining bagel (a Go-based secret scanner for home directories), Fleet (an MDM/osquery platform), and a proof-of-concept glue repo called Fleebag. Bagel runs on a schedule via LaunchAgent, outputs JSON findings, and Fleet policy queries check for critical secrets and can block non-compliant workstations from logging in via IdP integration (e.g., Entra Conditional Access). The post also outlines gaps: no code signing, no secret removal automation, and no visibility into already-exposed credentials. Alternatives for safer secret storage like 1Password developer tools and YubiKeys are mentioned.
