Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 7 of 9
- Web App Security
Review outbound webhook destination changes
Control where customer-configured callbacks can send data. Bind delivery jobs to reviewed endpoint versions and check DNS, redirects, secrets, and retries.
- Dependency security
Publish to npm, PyPI, and crates.io with OIDC
Set up trusted package publishing for TypeScript, Python, and Rust. Check package contents, restrict release authority, and verify the published result.
- Web App Security
Review password reset as an account state change
Map reset requests, token use, password replacement, and session handling. Test expiry, reuse, enumeration, and recovery without real customer accounts.
- Tenant Isolation & API Authorization
Secure Public Share Links
Give a public share link narrow data scope, expiry, and an honest revocation rule.
- Tenant Isolation & API Authorization
Secure Tenant Materialized Views
Check refresh and read permissions on derived tenant tables and materialized views.
- Review preparation
Separate finding confidence from security severity
Avoid treating a serious hypothesis as a confirmed defect. Record evidence confidence, technical severity, and business priority separately.
- Review preparation
Agree on data handling before a security review
Map what a security reviewer receives, where it goes, who can see it, and when it is removed. Use a practical evidence-handling worksheet.
- Review preparation
Use security evidence in a launch decision
Connect review findings, untested paths, fixes, and rollback plans to a clear launch decision. Use a readiness record without a false secure badge.
- Review preparation
Redact security evidence without losing its meaning
Remove credentials and personal data from a security report while preserving the ownership, sequence, and behavior needed to verify the finding.
- Review preparation
A security review scope your team can actually use
Define the assets, roles, actions, and evidence for a focused application security review. Use a scope worksheet that prevents silent expansion.
- Review preparation
Set stop conditions before security testing starts
Define when a reviewer must pause, who receives the alert, and what evidence is safe to retain. Avoid improvised decisions during a test.
- Review preparation
Keep third-party systems out of accidental test scope
Separate your application from payment, identity, email, and cloud providers. Map which activities you can authorize before a security review.
- Review preparation
Questions to ask before buying a security review
Compare security review proposals by scope, evidence, data handling, remediation, and retest. Avoid buying a report that cannot answer your decision.
- AI & MCP Permissions
Separate AI Read and Write Tools
Split AI read and write tools by effect, with separate authorization, approval, and synthetic denial tests.
- Credential & Access Lifecycle
Separate Human and Bot Accounts
Move automation off shared employee logins so each bot has its own owner, scope, credential, and audit trail.
- Tenant Isolation & API Authorization
Separate Tenant Analytics Events
Trace event ownership through collection, joins, reports, and access controls.
- Tenant Isolation & API Authorization
Separate User and Machine Authority
Keep a service credential from silently inheriting user privileges or expanding them.
- Web App Security
Set cache policy for private account responses
Separate public assets from private responses. Verify browser and shared-cache behavior with two synthetic accounts and explicit storage decisions.
- Web App Security
Set secure flags on session cookies
Inspect session cookies across login, renewal, and logout. Record transport, script access, host scope, and cross-site behavior in one worksheet.
- Credential & Access Lifecycle
Set Session Idle and Absolute Limits
Set server-enforced idle and absolute session limits, then test renewal, expiry, reauthentication, and revoked access.
- Credential & Access Lifecycle
Set Short-Lived Machine Credentials
Choose short-lived machine credentials where supported, and test renewal, expiry, failure, and emergency fallback paths.
- Review preparation
Prepare staging data without copying customers
Build synthetic tenants, records, and integrations for a security review. Preserve the access relationships without exposing production customer data.
- AI & MCP Permissions
Stop Stale Agent Jobs
Recheck permission before queued agent work executes after a role change, cancellation, or lease expiry.
- Credential & Access Lifecycle
Store API Key Verifiers Safely
Store API key identifiers and non-recoverable verifiers when the service only needs to check a presented key.