Sourced / Security blog
Security blog
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
204 articles / Page 9 of 9
- Web App Security
Verify an email change before moving account recovery
Treat email changes as sensitive identity transitions. Define pending state, reauthentication, address confirmation, notifications, and concurrent-change behavior.
- Web App Security
Document OpenAPI Webhooks and Verify Inbound Signatures
Model OpenAPI 3.1 webhook direction, payloads, and delivery rules, then verify raw-body signatures, tenant mapping, retries, and duplicates.
- AI & MCP Permissions
Verify MCP Authorization Issuers
Check issuer identity during MCP OAuth discovery and code exchange to prevent authorization-server mix-up.
- Credential & Access Lifecycle
Verify MFA Recovery Paths
Test account recovery when an MFA factor is lost without letting support or backup codes bypass normal identity checks.
- Dependency security
Verify Package Provenance
Check whether a package release has verifiable evidence that binds its published bytes to a source revision and build process.
- Tenant Isolation & API Authorization
Verify Membership Removal After SCIM
Check that SCIM deprovisioning removes tenant access across sessions and jobs.
- Tenant Isolation & API Authorization
Verify Tenant Deletion Paths
Trace a tenant deletion through rows, files, search, jobs, and retained copies.
- Review preparation
Turn a scanner alert into a defensible finding
Check applicability, reachability, evidence, and impact before treating an automated alert as a confirmed vulnerability in your application.
- Tenant Isolation & API Authorization
Write PostgreSQL RLS Policy Tests
Test PostgreSQL row security for each role and command that accesses tenant rows.
- Tenant Isolation & API Authorization
Detect Breaking OpenAPI Changes with oasdiff
Build an oasdiff CI check against the released API contract. Review request and response direction, generated SDK changes, and authentication changes separately.
- Tenant Isolation & API Authorization
OpenAPI Validator: Redocly and Spectral in CI
Configure Redocly CLI or Spectral for repeatable OpenAPI validation. Separate document errors, team rules, payload checks, and runtime authorization evidence.
- Tenant Isolation & API Authorization
OpenAPI 3.0 vs 3.1: Which Should You Use?
Choose OpenAPI 3.0 or 3.1 using a toolchain acceptance record. Migrate nullability, examples, references, and webhooks without silently changing the contract.