» Tag
authentication
29 postsAgent payments need separation of duties, not just signatures
A signature alone can't secure agent payments; execution must be bound to a still-valid mandate, verified by a party that cannot forge it.
Why Most Security Keys Ship Without a PIN
Most FIDO2 security keys ship without a PIN. How does this impact user security?
Presigned URLs: A Security Vulnerability?
Presigned URLs are viewed as a security vulnerability. Systems like Tigris face risks with this feature.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comMCP Clients Can't Easily Authenticate With Entra: mcp-sso Bridges It
MCP servers can't easily complete OAuth with Entra ID or Cloudflare Access because they lack Dynamic Client Registration; mcp-sso bridges the gap.
Building auth on a store that only does get and put
How we built an authentication system on a store that only supports get and put, using key design and ETag-based concurrency instead of SQL.
Six Hidden Bugs Found in a Vertex AI and WIF Setup on EC2
A detailed account of six distinct bugs hit while deploying Gemini via Vertex AI with Workload Identity Federation on AWS EC2, and how each was diagnosed.
WebAuthn Level 3: New Features for Passkeys
WebAuthn Level 3 introduces passkey support and improved usability for developers.
We Offer All Features in the Free Plan
Our free plan includes all features up to 250 users. Unlike competitors, we provide essential security functions at no cost.
Logging Into Higgsfield CLI on a Headless Server: The localhost Trap
Why OAuth PKCE CLI logins fail on headless servers: localhost is per-machine, redirect URIs are allowlisted, and how replaying the callback URL manually solves it.
Why Trusting the Database for API Auth Is a Security Risk
A technical look at how HMAC-SHA512 signing, cryptographic peppers, and layered tenancy checks prevent SQL injection attacks from turning into full tenant takeovers.