Sourced / Security blog
Credential & Access Lifecycle
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
30 articles / Page 1 of 2
- Credential & Access Lifecycle
Audit Local Environment File Access
Find local environment files that hold secrets, identify who can read them, and check that builds do not copy them into artifacts.
- Credential & Access Lifecycle
Define Credential Ownership
Assign each production credential a named owner, backup owner, rotation method, incident contact, and orphaned-key decision.
- Credential & Access Lifecycle
Invalidate Sessions After Access Changes
Trace role removal through application sessions, tokens, caches, and queued jobs so revoked access cannot continue.
- Credential & Access Lifecycle
Inventory Production Secrets
Build a production-secret register that names each credential's owner, storage path, scope, callers, and verified rotation method.
- Credential & Access Lifecycle
Limit Personal Access Tokens
Replace broad long-lived personal access tokens with scoped, owned credentials and verify each retired token stops working.
- Credential & Access Lifecycle
Offboard Developer Access
Remove a departing developer's sessions, grants, keys, and recovery routes across providers with dated verification receipts.
- Credential & Access Lifecycle
Pin JWT Verification Keys
Keep a JWT header from selecting an arbitrary verification key, URL, or algorithm outside the server's trusted issuer policy.
- Credential & Access Lifecycle
Plan API Key Rotation
Plan a provider API key change with dual-key overlap, caller inventory, health checks, rollback limits, and old-key rejection evidence.
- Credential & Access Lifecycle
Protect CI Deployment Secrets
Map which CI workflows can read deployment secrets, then test untrusted pull requests and least-privilege release jobs.
- Credential & Access Lifecycle
Protect Credential Backups
Map secret copies in backups and restore paths, then test access, retention, and use of retired credentials after recovery.
- Credential & Access Lifecycle
Reconcile Provider Access After Revocation
Compare local access records with provider grants after revocation and resolve every stale, missing, or unexpected permission.
- Credential & Access Lifecycle
Redact Secrets From Build Logs
Test CI logs and failure traces with synthetic markers so deployment credentials and derived values do not appear in output.
- Credential & Access Lifecycle
Reduce Third-Party OAuth Scopes
Map each third-party OAuth scope to a live feature, remove unused grants, and plan reconsent for necessary changes.
- Credential & Access Lifecycle
Remove Stale Admin Grants
Find administrator grants with no current job need, remove them at the provider, and prove normal access still works.
- Credential & Access Lifecycle
Retire Duplicate Service Keys
Find service credentials shared across unrelated callers, split them by workload, and retire the common key with proof.
- Credential & Access Lifecycle
Review Break-Glass Access
Define emergency access triggers, short expiry, independent approval, audit events, and a post-use review before an incident.
- Credential & Access Lifecycle
Review SSO Session Boundaries
Trace identity-provider login and logout through application sessions so sign-out, role changes, and reauthentication behave as stated.
- Credential & Access Lifecycle
Rotate OAuth Refresh Tokens
Handle OAuth refresh-token replacement, reuse detection, token-family revocation, and client recovery without exposing tokens.
- Credential & Access Lifecycle
Rotate Session IDs on Privilege Change
Replace session identifiers after login or privilege elevation and prove the old identifier cannot inherit new authority.
- Credential & Access Lifecycle
Rotate Webhook Signing Secrets
Rotate webhook signing keys without losing valid deliveries or accepting retired signatures after the overlap window ends.
- Credential & Access Lifecycle
Run Periodic Access Reviews
Compare live grants with current job needs and record keep, narrow, remove, or hold decisions with provider evidence.
- Credential & Access Lifecycle
Separate Human and Bot Accounts
Move automation off shared employee logins so each bot has its own owner, scope, credential, and audit trail.
- Credential & Access Lifecycle
Set Session Idle and Absolute Limits
Set server-enforced idle and absolute session limits, then test renewal, expiry, reauthentication, and revoked access.
- Credential & Access Lifecycle
Set Short-Lived Machine Credentials
Choose short-lived machine credentials where supported, and test renewal, expiry, failure, and emergency fallback paths.