Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 4 of 9
- Web App Security
Make webhook effects safe to repeat
Design an event-processing record that survives retries and worker crashes. Test concurrent delivery, durable acceptance, and downstream side effects.
- Tenant Isolation & API Authorization
Map SSO Users to Tenants
Define how a verified SSO identity becomes a tenant membership and role.
- Tenant Isolation & API Authorization
Map Tenant Data Boundaries Before a Review
Trace each tenant-owned record from entry point to storage and output before you review isolation.
- Dependency security
Match a Release Artifact to Its Source
Tie a deployed release file to the reviewed source commit by checking the artifact digest, provenance, and release record.
- AI & MCP Permissions
MCP Servers: Architecture, OpenAPI Readiness, and Security
Understand MCP server roles and transports, assess OpenAPI tool readiness, and test permissions, credentials, and launch blockers.
- Dependency security
Merge advisory aliases without merging different issues
Reconcile CVE, GHSA, and other advisory identifiers through explicit alias evidence. Preserve affected packages, source revisions, and separate upstream relationships.
- Dependency security
Minimize GitHub Actions Token Permissions
Give each GitHub Actions job only the token permissions it needs, with reviewed write exceptions and negative tests.
- AI & MCP Permissions
Minimize MCP Client Scopes
Choose the smallest MCP scope set for first connection and test that protected tools stay unavailable.
- Review preparation
What a no-findings security report should say
Read a clean security review without treating it as proof of perfect security. Check coverage, blocked tests, versions, and the next review trigger.
- Web App Security
Separate upload names from storage identity
Treat the original filename as display data. Define server-owned storage keys, collision behavior, Unicode handling, and safe download-name serialization.
- Credential & Access Lifecycle
Offboard Developer Access
Remove a departing developer's sessions, grants, keys, and recovery routes across providers with dated verification receipts.
- Tenant Isolation & API Authorization
OpenAPI Security: API Keys, Schemas, and Auth
Fix API key declarations and readOnly/writeOnly schema gaps, then test that your API enforces its documented security requirements.
- Tenant Isolation & API Authorization
Partition Cache Keys by Tenant
Check that cache keys cannot return one tenant's data to another.
- Review preparation
Write rules of engagement that prevent surprises
Turn an approved security review scope into operating rules for timing, rate limits, escalation, evidence, and changes during the test.
- Review preparation
Check authorization before a penetration test
Confirm who can approve a security test, which systems are covered, and when permission ends. Use a practical authorization checklist.
- Review preparation
What evidence belongs in a security finding?
Build findings that engineering can verify and fix. Keep the affected behavior, expected policy, version, impact, and uncertainty connected.
- Review preparation
Retest a security fix without losing the evidence
Verify the repaired behavior on the deployed build, include a legitimate allow case, and record what remains outside the retest.
- Review preparation
Build a test account matrix for a SaaS review
Choose the roles, tenants, and account states needed to test SaaS authorization. Use a matrix with expected permissions and clear reset rules.
- Dependency security
Pin GitHub Actions by Commit
Replace mutable GitHub Action tags with reviewed commit IDs and keep an owner and update path for each pinned action.
- Credential & Access Lifecycle
Pin JWT Verification Keys
Keep a JWT header from selecting an arbitrary verification key, URL, or algorithm outside the server's trusted issuer policy.
- Credential & Access Lifecycle
Plan API Key Rotation
Plan a provider API key change with dual-key overlap, caller inventory, health checks, rollback limits, and old-key rejection evidence.
- Tenant Isolation & API Authorization
Plan a Tenant Data Migration
Move one tenant between data stores without changing who can access it.
- Dependency security
Plan a package upgrade around the affected behavior
Choose a corrective version with evidence. Trace every dependency path, select targeted regressions, and verify the built and deployed artifact after the update.
- Tenant Isolation & API Authorization
Prevent Cross-Tenant CDN Cache Leaks
Classify authenticated responses before an edge cache can store them.