THE PUBLICATION ARCHIVE
Cybersecurity
Security architecture, exposure, and operational risk.
Token Binding Changes the Credential Lifecycle You Must Operate
Binding a token to a key can reduce the usefulness of a copied credential. The engineering decision includes how that key is created, protected, rotated, recovered, and associated…
Google OAuth adds DPoP binding for refresh tokens
Google’s OAuth Platform has added DPoP binding for refresh tokens. Google describes cryptographic binding to a client-held key, while short-lived access tokens remain bearer tokens in its implementation.
Agent Autonomy Should Grow Inside an Execution Boundary
A team should not have to choose between useful automation and unrestricted access to a developer’s machine. Execution boundaries let autonomy be discussed in terms of specific operations…
GitHub makes local Copilot sandboxing generally available
GitHub has announced general availability of local sandboxing for Copilot. Its description covers policy-based limits on filesystem, network, and credential access for agent-initiated tools.
A Blocked Request and a Successful Exploit Are Different Events
Security reporting should distinguish an attempted attack, a blocked request, and observed exposure. Treating those as the same event creates noisy dashboards and uncertain incident priorities.
Cloudflare adds request-and-response correlation to WAF detection
Cloudflare has announced full transaction detection for its web application firewall, correlating requests with their responses. The company says the capability helps distinguish suspicious input from outcomes such…
Key Location Is Only One Part of Data Sovereignty
Sovereignty requirements become more actionable when expressed as separate controls. Key custody, key use, data storage, plaintext processing, and operator access should not be collapsed into one regional…
Cloudflare outlines post-quantum changes to GeoKey Manager
Cloudflare has described a redesigned GeoKey Manager using hybrid ML-KEM-768 and X25519 protection for geographically controlled key use. Its account distinguishes the region where keys may be unwrapped…
Design DDoS Response for the First Minute
A defense process that starts only after a human joins a bridge may miss much of a short attack. The CTO question is whether detection, protection, and customer…
Cloudflare Q3 report highlights a shift toward short DDoS bursts
Cloudflare’s third-quarter DDoS report describes a shift toward frequent, shorter attacks across its network. The company says 96% of the network-layer attacks it mitigated ended in under ten…