Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 3 of 9
- Web App Security
Set archive extraction boundaries before unpacking
Review member paths, links, expansion limits, and cleanup for uploaded archives. Use a controlled scratch directory and small fixtures to verify containment.
- Tenant Isolation & API Authorization
Fix BOLA on Record Endpoints
Move record ownership checks into each API operation and test both allowed and denied access.
- Tenant Isolation & API Authorization
Fix OAuth2 Security Scheme Codegen
Trace OAuth2 security schemes into a generated client and deny calls when the token is missing.
- Tenant Isolation & API Authorization
Gate Admin API Functions
Verify role checks on privileged API functions, not only on admin screens.
- AI & MCP Permissions
Gate High-Impact Agent Actions
Require a server-verified human decision before an agent can send, export, delete, refund, or change access.
- Dependency security
Generate an SBOM for the artifact you release
Build a release inventory from packaged software. Record the artifact digest, generator context, dependency relationships, and known collection gaps.
- AI & MCP Permissions
Grade Agent Permission Tests
Score both permitted work and denied effects in synthetic agent tests, including incomplete and uncertain cases.
- AI & MCP Permissions
Grok Bot API Tool Safety Checklist
Limit Grok-connected MCP tools with an explicit inventory, caller checks, credential isolation, and safe test cases.
- Dependency security
Reassess advisories when records change or are withdrawn
Preserve advisory history while revising local triage. Distinguish withdrawal, range correction, replacement records, and a verified deployed fix.
- Dependency security
Interpret OpenSSF Scorecard Results
Read individual OpenSSF Scorecard checks in context and turn weak results into targeted supply-chain review tasks.
- Credential & Access Lifecycle
Invalidate Sessions After Access Changes
Trace role removal through application sessions, tokens, caches, and queued jobs so revoked access cannot continue.
- Dependency security
Inventory dependencies in the release you actually ship
Connect declared packages, resolved dependency paths, and shipped components. Record direct owners, transitive paths, build-only use, and inventory gaps.
- Dependency security
Inventory Exposed Software Components
Map software versions to internet-facing services and owners so dependency alerts reach the systems that can be affected.
- Credential & Access Lifecycle
Inventory Production Secrets
Build a production-secret register that names each credential's owner, storage path, scope, callers, and verified rotation method.
- Web App Security
Limit what image processing workers can reach
Review converter formats, filesystem access, credentials, and resource limits. Verify the worker's actual restrictions with harmless boundary tests.
- Tenant Isolation & API Authorization
Isolate Search Autocomplete by Tenant
Check suggestions and counts that appear before a full search result.
- Tenant Isolation & API Authorization
Isolate Tenant Search Results
Trace tenant ownership through search ingestion, indexing, filtering, and result display.
- Tenant Isolation & API Authorization
Isolate Tenant Vector Retrieval
Bind vector records and retrieval filters to verified tenant ownership.
- AI & MCP Permissions
Keep Agent Secrets Out of Prompts
Keep provider credentials in a server-side broker and test that prompts, tool results, and logs never expose them.
- Tenant Isolation & API Authorization
Limit API Object Properties by Role
Define field-level read permissions before serializing API objects.
- Tenant Isolation & API Authorization
Limit Bulk Export Authority
Give bulk exports a separate grant, size policy, and audit record.
- AI & MCP Permissions
Limit MCP Authorization SSRF
Constrain MCP OAuth discovery URLs, DNS results, redirects, and egress before the client fetches metadata.
- Credential & Access Lifecycle
Limit Personal Access Tokens
Replace broad long-lived personal access tokens with scoped, owned credentials and verify each retired token stops working.
- Web App Security
Record authentication events without recording secrets
Create a minimal authentication event schema. Verify login, recovery, and factor-change records while excluding credentials, session values, and private request bodies.