Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 8 of 9
- Web App Security
Separate uploaded bytes from application content
Map upload storage, processing, and serving identities. Verify that uploaded files cannot become executable site content or bypass the download policy.
- Tenant Isolation & API Authorization
Test Cross-Tenant Object Reads Safely
Use synthetic records to verify that object reads enforce tenant ownership.
- Tenant Isolation & API Authorization
Test Cross-Tenant Writes Safely
Verify that create, update, and delete operations reject another tenant's records without side effects.
- Tenant Isolation & API Authorization
Test Organization Switching
Verify that tenant switching updates API, cache, and job context together.
- AI & MCP Permissions
Test Prompt Injection in an Owned Lab
Build a synthetic prompt-injection case with a legitimate task, forbidden effect, positive control, and tool-event evidence.
- Tenant Isolation & API Authorization
Test Tenant Feature Flag Boundaries
Verify that a feature flag never grants access outside its tenant or role policy.
- AI & MCP Permissions
Treat Repository Instructions as Data
Read customer repository instructions as untrusted evidence, not worker policy, and test the boundary in an owned lab.
- Credential & Access Lifecycle
Triage an Exposed Secret
Contain an exposed credential by identifying its provider, scope, possible use, replacement path, and revocation evidence.
- Dependency security
Triage False-Positive Dependency Alerts
Check ecosystem, resolved version, artifact, and affected code path before closing a dependency alert as non-applicable.
- Review preparation
Triage Inbound Vulnerability Reports
Turn an external report into a private, reproducible case with scope, impact, owner, and a clear next response.
- Tenant Isolation & API Authorization
Trust Proxy Identity Headers Safely
Document each proxy hop that sets user or tenant identity and test direct-origin denial.
- Dependency security
Unblock Transitive Dependency Fixes
Trace a vulnerable transitive package to its parent dependency, then choose a tested override, upstream update, or replacement.
- Dependency security
Use dated EPSS scores with local exposure evidence
Keep exploitation forecasts separate from asset risk. Record EPSS date, probability, percentile, local applicability, and the remediation decision.
- AI & MCP Permissions
Validate AI Tool Result Schemas
Parse AI tool responses into bounded approved fields and reject malformed, oversized, or unexpected output.
- Credential & Access Lifecycle
Validate JWT Issuer and Audience
Reject JWTs from the wrong issuer or for another API, even when the signature and token lifetime are otherwise valid.
- AI & MCP Permissions
Validate MCP Localhost Redirects
Review desktop OAuth loopback callbacks for exact host and path matching, port binding, state, and one-time use.
- AI & MCP Permissions
Validate MCP Token Audience
Reject an MCP access token issued for another resource, even when its issuer and lifetime are valid.
- Web App Security
Validate uploaded file types with explicit evidence
Compare allowed extensions, declared MIME types, and parser results. Build a bounded upload test set that checks mismatches without using live malicious files.
- Dependency security
Match advisory ranges to exact installed versions
Compare package ecosystem, resolved versions, advisory intervals, and vendor patches. Keep version matches separate from reachability and local impact.
- AI & MCP Permissions
Verify Agent Approval Records
Bind each human approval to one exact agent action, caller, tenant, input digest, and expiry.
- Web App Security
Verify security headers across real response paths
Build a route and response matrix for browser headers. Check edge delivery, errors, downloads, and policy meaning rather than counting header names.
- Dependency security
Verify Build Provenance Claims
Check a provenance statement against the artifact digest, trusted builder identity, source revision, and expected build path.
- Credential & Access Lifecycle
Verify Copied Key Revocation
Confirm that a copied API key is invalid at its provider, while the replacement credential still serves each authorized caller.
- Credential & Access Lifecycle
Verify Credential Replacement
Prove that a replacement credential works for every intended caller while the retired key fails at the issuing provider.