Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 2 of 9
- Web App Security
Set upload budgets across requests and processing
Define per-file, request, storage, and processing limits. Test streamed uploads, concurrent reservations, partial cleanup, and legitimate near-limit files.
- AI & MCP Permissions
Budget Agent Tool Operations
Set per-task limits for tool calls, external spend, data volume, retries, and writes, then test loop stopping.
- Tenant Isolation & API Authorization
Budget API Rate Limits per Tenant
Separate tenant, user, and global API limits so one customer cannot exhaust another.
- Tenant Isolation & API Authorization
Build a Tenant Authorization Matrix
Define allowed and denied actions for each role, resource, and tenant relationship.
- Tenant Isolation & API Authorization
Carry Tenant Context Into Async Jobs
Bind each background job to a trusted tenant and recheck permission before sensitive work.
- Dependency security
Check whether an SBOM covers the released software
Compare an SBOM with packaged components and a defined acceptance profile. Track missing identities, versions, suppliers, relationships, and coverage gaps.
- Tenant Isolation & API Authorization
Check Tenant Notification Recipients
Verify that each notification reaches only current, authorized recipients.
- Tenant Isolation & API Authorization
Check Tenant Scope in SQL Joins
Review joins between tenant-owned tables and test mixed-tenant identifiers.
- Web App Security
Check browser origins before WebSocket upgrades
Define a WebSocket handshake policy for browser and machine clients. Test exact origins, missing origin handling, authentication, and proxy behavior.
- Tenant Isolation & API Authorization
Choose API Denial Responses
Choose 401, 403, or concealed 404 responses without leaking private resource details.
- AI & MCP Permissions
Constrain MCP Sampling Requests
Review legacy MCP sampling requests for user approval, data limits, provider destination, and migration from deprecated sampling.
- Web App Security
Constrain URL fetches in import and preview features
Define which destinations an application may fetch. Review URL parsing, resolved addresses, redirects, response limits, and the worker's network access.
- Tenant Isolation & API Authorization
Constrain Tenant Admin Overrides
Define narrow, logged exceptions to normal tenant authorization.
- AI & MCP Permissions
Contain Untrusted AI Tool Output
Keep retrieved pages, tool errors, and structured results from changing an agent's instructions or tool permissions.
- Tenant Isolation & API Authorization
Control Support Impersonation
Require a named, narrow, time-limited support grant and an audit trail for every action.
- Dependency security
Document a security backport when an upgrade is blocked
Evaluate a backport against a normal corrective upgrade. Record the blocker, patch identity, maintenance owner, regression evidence, and exit plan.
- Credential & Access Lifecycle
Define Credential Ownership
Assign each production credential a named owner, backup owner, rotation method, incident contact, and orphaned-key decision.
- Tenant Isolation & API Authorization
Design Synthetic Tenant Test Fixtures
Build safe test records that reveal both cross-tenant leaks and false denials.
- Tenant Isolation & API Authorization
Design a Tenant Role Permission Map
Translate tenant roles into explicit resource and action decisions.
- Dependency security
Detect manifest and lockfile drift before release
Verify that a clean install respects the reviewed dependency graph. Record package-manager settings, workspace scope, install scripts, and unexpected lockfile changes.
- Web App Security
Review output encoding where user content renders
Trace user-controlled values into text, attributes, links, and rich content. Build rendering assertions that preserve valid text without allowing execution.
- AI & MCP Permissions
Enforce RAG Retrieval Access Controls
Apply current user and tenant permissions before RAG chunks enter model context, including snippets and caches.
- Dependency security
Expire Dependency Risk Exceptions
Set a time limit and recheck trigger for dependency waivers so temporary risk decisions do not become permanent defaults.
- Tenant Isolation & API Authorization
Expire Tenant Signed Downloads
Set issue, use, expiry, and revocation rules for signed tenant file links, then verify them at storage and edge.