security 2 Staged npm publishing is production change control Oct 22, 2026 Your AI API key should be a break-glass credential now Oct 18, 2026