Sourced / Security blog
Tenant Isolation & API Authorization
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
63 articles / Page 3 of 3
- Tenant Isolation & API Authorization
Secure Public Share Links
Give a public share link narrow data scope, expiry, and an honest revocation rule.
- Tenant Isolation & API Authorization
Secure Tenant Materialized Views
Check refresh and read permissions on derived tenant tables and materialized views.
- Tenant Isolation & API Authorization
Separate Tenant Analytics Events
Trace event ownership through collection, joins, reports, and access controls.
- Tenant Isolation & API Authorization
Separate User and Machine Authority
Keep a service credential from silently inheriting user privileges or expanding them.
- Tenant Isolation & API Authorization
Test Cross-Tenant Object Reads Safely
Use synthetic records to verify that object reads enforce tenant ownership.
- Tenant Isolation & API Authorization
Test Cross-Tenant Writes Safely
Verify that create, update, and delete operations reject another tenant's records without side effects.
- Tenant Isolation & API Authorization
Test Organization Switching
Verify that tenant switching updates API, cache, and job context together.
- Tenant Isolation & API Authorization
Test Tenant Feature Flag Boundaries
Verify that a feature flag never grants access outside its tenant or role policy.
- Tenant Isolation & API Authorization
Trust Proxy Identity Headers Safely
Document each proxy hop that sets user or tenant identity and test direct-origin denial.
- Tenant Isolation & API Authorization
Verify Membership Removal After SCIM
Check that SCIM deprovisioning removes tenant access across sessions and jobs.
- Tenant Isolation & API Authorization
Verify Tenant Deletion Paths
Trace a tenant deletion through rows, files, search, jobs, and retained copies.
- Tenant Isolation & API Authorization
Write PostgreSQL RLS Policy Tests
Test PostgreSQL row security for each role and command that accesses tenant rows.
- Tenant Isolation & API Authorization
Detect Breaking OpenAPI Changes with oasdiff
Build an oasdiff CI check against the released API contract. Review request and response direction, generated SDK changes, and authentication changes separately.
- Tenant Isolation & API Authorization
OpenAPI Validator: Redocly and Spectral in CI
Configure Redocly CLI or Spectral for repeatable OpenAPI validation. Separate document errors, team rules, payload checks, and runtime authorization evidence.
- Tenant Isolation & API Authorization
OpenAPI 3.0 vs 3.1: Which Should You Use?
Choose OpenAPI 3.0 or 3.1 using a toolchain acceptance record. Migrate nullability, examples, references, and webhooks without silently changing the contract.