Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 1 of 9
- Review preparation
Scope an AI security review around real actions
Map model inputs, retrieved data, tool permissions, approvals, and external effects. Define an AI review that tests boundaries rather than clever prompts.
- Web App Security
Restrict return URLs and external redirects
Review return-to parameters without trusting URL prefixes. Define accepted destinations, fallback behavior, and browser-visible redirect tests.
- Review preparation
Build an API inventory for an authorization review
Inventory API operations, roles, ownership rules, and background effects. Find gaps between your schema and the routes that actually run.
- AI & MCP Permissions
Apply MCP Scope Step-Up
Request a stronger MCP scope only when a protected tool needs it, and deny the tool until new consent is verified.
- Dependency security
Assess Maintainer Security Signals
Review package stewardship, release controls, and response history without treating popularity or one score as a safety guarantee.
- Dependency security
Assess vulnerable code paths without overstating certainty
Trace an affected dependency from application entry points to the vulnerable behavior. Record supporting evidence, counterevidence, dynamic paths, and unknowns.
- AI & MCP Permissions
Audit AI Tool Calls Without Secrets
Record agent tool decisions and downstream effects without storing raw credentials, private payloads, or transcripts.
- Web App Security
Audit CORS rules against real browser origins
Create an origin and credential matrix for your API. Check preflight behavior, actual responses, cache variation, and unexpected origin matches.
- Credential & Access Lifecycle
Audit Local Environment File Access
Find local environment files that hold secrets, identify who can read them, and check that builds do not copy them into artifacts.
- Tenant Isolation & API Authorization
Audit PostgreSQL RLS Bypass Roles
Find roles and execution paths that can read past PostgreSQL row security.
- Tenant Isolation & API Authorization
Audit Tenant Access Changes
Record tenant access grants and removals without logging secret values.
- Tenant Isolation & API Authorization
Audit Tenant Filters on List APIs
Trace list queries and test that each response contains only records the caller may see.
- Tenant Isolation & API Authorization
Authorize Each Batch API Operation
Check every item in a batch request against the caller's role and tenant.
- Web App Security
Check file access before issuing a download
Trace a file identifier to its owner, accepted version, and download response. Test revoked access, direct-object paths, and the limits of signed URLs.
- Tenant Isolation & API Authorization
Authorize GraphQL Node Lookups
Enforce object ownership when a GraphQL node ID resolves to a tenant record.
- Tenant Isolation & API Authorization
Authorize Nested GraphQL Fields
Apply tenant and field permissions inside nested GraphQL resolvers.
- Tenant Isolation & API Authorization
Authorize Tenant Webhook Subscriptions
Check who may create or change an outbound webhook subscription for a tenant.
- Web App Security
Authorize WebSocket actions after the connection opens
Map message types to resources and current permissions. Test subscriptions, role changes, session expiry, and cross-tenant messages on an existing connection.
- AI & MCP Permissions
Avoid MCP Token Passthrough
Keep client-to-MCP tokens out of upstream API calls by separating audiences, credentials, and per-user authorization.
- Tenant Isolation & API Authorization
Bind Queue Messages to Tenants
Validate tenant and resource ownership at both ends of a queue.
- Web App Security
Check framing protection on account actions
Inventory pages that change account state and verify their frame policy. Test approved embedding separately from blocked framing on sensitive screens.
- Tenant Isolation & API Authorization
Block Sensitive Field Mass Assignment
Allow only approved input fields when an API creates or updates a record.
- Tenant Isolation & API Authorization
Bound API Replay Windows
Set a clear validity window and duplicate policy for signed API requests.
- AI & MCP Permissions
Bound Multi-Agent Handoffs
Limit each child agent to a verified subset of the parent task's tools, data, time, and action scope.