Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 6 of 9
- AI & MCP Permissions
Resolve MCP Tool Name Collisions
Find duplicate MCP tool names across servers and verify that names, handlers, and scopes remain distinct.
- Credential & Access Lifecycle
Retire Duplicate Service Keys
Find service credentials shared across unrelated callers, split them by workload, and retire the common key with proof.
- AI & MCP Permissions
Review AI Tool Catalog Changes
Compare tool names, schemas, handlers, scopes, and results before a changed catalog reaches an agent.
- Credential & Access Lifecycle
Review Break-Glass Access
Define emergency access triggers, short expiry, independent approval, audit events, and a post-use review before an incident.
- AI & MCP Permissions
Review Delegated Agent OAuth
Trace user consent through an MCP client, server, and upstream API with separate token audiences and object checks.
- Dependency security
Review a dependency update before merging it
Check the advisory, resolved dependency graph, package source, behavior changes, and actual test results before approving an automated dependency update.
- Tenant Isolation & API Authorization
Review Organization Invite Boundaries
Map who may invite, accept, promote, and revoke members in a tenant.
- Dependency security
Review Package Registry Trust
Check a new package's namespace, publisher rights, release history, and exact artifact before adding it to a build.
- Credential & Access Lifecycle
Review SSO Session Boundaries
Trace identity-provider login and logout through application sessions so sign-out, role changes, and reauthentication behave as stated.
- Web App Security
Roll out CSP with a reviewable enforcement plan
Move a Content Security Policy from observation to enforcement. Track script owners, violation causes, staged rollout decisions, and rollback evidence.
- Credential & Access Lifecycle
Rotate OAuth Refresh Tokens
Handle OAuth refresh-token replacement, reuse detection, token-family revocation, and client recovery without exposing tokens.
- Credential & Access Lifecycle
Rotate Session IDs on Privilege Change
Replace session identifiers after login or privilege elevation and prove the old identifier cannot inherit new authority.
- Credential & Access Lifecycle
Rotate Webhook Signing Secrets
Rotate webhook signing keys without losing valid deliveries or accepting retired signatures after the overlap window ends.
- Tenant Isolation & API Authorization
Route Callbacks to the Correct Tenant
Resolve a verified provider callback to the owning tenant before changing records.
- Tenant Isolation & API Authorization
Run Authorization Regression in CI
Keep allowed and denied tenant access tests in the release pipeline.
- Credential & Access Lifecycle
Run Periodic Access Reviews
Compare live grants with current job needs and record keep, narrow, remove, or hold decisions with provider evidence.
- Web App Security
Build a web application security release gate
Tie release decisions to changed security boundaries. Require named evidence for authentication, uploads, webhooks, headers, and unresolved exceptions.
- Review preparation
Prepare a safe source snapshot for security review
Send a versioned, minimized code snapshot for review without secrets, local configuration, or executable setup steps. Keep a clear evidence manifest.
- Tenant Isolation & API Authorization
Scope Cross-Tenant Integrations
Bind each external integration to its tenant owner and verify every use against current access.
- Tenant Isolation & API Authorization
Scope Idempotency Keys by Tenant
Bind idempotency records to the caller, tenant, operation, and request meaning.
- Tenant Isolation & API Authorization
Scope Service Accounts by Tenant
Limit machine credentials to the tenant resources and actions they need.
- Tenant Isolation & API Authorization
Scope Tenant Data Exports
Protect the full export lifecycle, from request authorization to file download and expiry.
- Tenant Isolation & API Authorization
Scope Object Storage by Tenant
Trace tenant ownership from database rows to blob keys and access policies.
- AI & MCP Permissions
Screen RAG Ingestion Permissions
Record who can add RAG documents, how each source is classified, and which access rules survive indexing.