How to Give an Agent a Query Language Instead of a Code Interpreter
A four-step pattern for letting a document agent write validated aggregation pipelines instead of arbitrary code, so results come back shaped and tenancy stays enforced.
Loading…
Topic
Security
181 posts about Security. Every summary links to the original.
- 181 posts
- 30 companies
- 8 explainers
See the idea
Security explainers
Anatomy of a Branded Call: The Trust Chain from Dial to Display
The Branded Calling trust chain, layer by layer: how identity, STIR/SHAKEN attestation, Rich Call Data, and carrier delivery combine so a verified brand name reaches the recipient's screen.
Backdoor Defense Is a Trade-off, Not a Scanner
A model that passes benchmarks can still defect only on a trigger. This explainer maps the trade-off between deeper backdoor verification and the friction, latency, and cost it adds.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Astronomy Geek to Oktanaut: Landing as a Dev Advocate at Okta
Akanksha Bhasin joins Okta as an “Oktanaut” in Developer Relations after more than six years building developer communities and four years focused on Developer Relations. Her path began with experiments in Arduino, programming, and AI applications, then shifted toward Voice AI after Google Assistant launched in 2018; she built applications for Google Assistant and Alexa and was later featured at Google I/O. She taught these technologies at meetups and colleges across India, founded Women in Voice, India, led Google Developer Groups, and helped organize events including DevFests that gathered more than 3,000 developers. At Okta, she wants to help independent software vendors and developers secure user identities, treating identity security and access management as foundational to enterprise applications rather than a checklist item.
We Were Wrong About GPUs
Fly.io’s GPU bet was intended to give internet-facing apps fast AI/ML inference through Fly GPU Machines, which pair a hardware-mapped Nvidia GPU with a Fly Machine. Building them required dedicated GPU servers, Intel Cloud Hypervisor with PCI passthrough, driver work, orchestrator changes, security assessments, and handling large model-weight files. The product has not found product-market fit because most software developers want LLM APIs and services such as OpenAI, Anthropic, Claude, GPT, Replicate, or RunPod rather than raw GPUs, while serious GPU users seek much larger clusters and lightweight users may be too uncertain a market. L40S demand exists, but those GPUs are not driving the core business. Fly.io will keep existing GPU Machines but does not plan a near-term v2, concluding that the bet was worth making without compromising its isolation or developer experience.
VSCode’s SSH Agent Is Bananas
VSCode’s remote-editing flow over SSH is examined as a concern for running LLM-driven agent workflows on remote machines. The motivation is to keep iterative code generation and execution away from a development laptop, ideally on a clean-slate Linux instance that starts instantly and cannot damage the host. Unlike Emacs Tramp, which operates through commands on the remote connection, VSCode uses a Bash snippet stager to download an agent, including a binary Node installation. That agent communicates over port-forwarded SSH through a WebSockets connection to the VSCode front end and can browse the filesystem, edit arbitrary files, launch shell PTYs, and persist itself. The author says this raises concerns for development servers and especially production incident work, while noting a custom Fly Machine connection avoids needing this mechanism.
How to Submit Your System for Cross
Enterprise applications with SSO still need scalable identity management for customer organizations, including user provisioning, updates, and deprovisioning. This guide presents SCIM (System for Cross-domain Identity Management) as the standards-based connection to Okta for automating those lifecycle operations and controlling access. SCIM can synchronize users in real time as employees join, leave, or change roles, while reducing manual work and inconsistent deprovisioning risks. To submit the integration to the Okta Integration Network, partners need an Okta Integrator Free Plan, two Runscope test links for CRUD and SPEC tests, manual Okta SCIM integration tests, a provisioning-enabled instance, confirmation, and a publicly accessible SCIM server. The submission can expose an integration to Okta’s customer base of 18,000+ organizations and provide verified enterprise-ready status.
Embracing passwordless authentication with Grab’s Passkey
Grab’s Passkey adds passwordless authentication to its app to address phishing, keystroke-logging, brute-force, and other security threats associated with passwords plus the friction of OTP-based login. Built on the FIDO standard and implemented through WebAuthn, the flow uses a backend, frontend, and authenticator: the authenticator creates and stores a passkey, while Grab stores the public key and metadata. Registration uses a server-generated challenge and parameters including rp.id, user information, resident-key requirements, and supported public-key algorithms; sign-in returns a credential whose signature is verified against the stored public key. Google Password Manager and iCloud Keychain can sync passkeys across supported devices, and users authenticate with their screen lock rather than entering a password or waiting for an OTP. The implementation is described as faster, smoother, phishing-resistant login with potential savings on third-party authentication and messaging costs, while Grab plans to evaluate web login expansion through adoption, feedback, and usage data.
MongoDB 8.0: Raising The Bar
MongoDB 8.0, the latest version of the document database, is now generally available, delivering significant performance and security improvements. The release features 36% better read throughput, 56% faster bulk writes, 20% faster concurrent writes during data replication, and 200% faster complex aggregations of time series data. MongoDB’s internal build system, which runs on MongoDB, saw query latencies drop by approximately 75% after upgrading. The company also reports that customer OCELL experienced queries running twice as fast. MongoDB 8.0 includes sharding enhancements for up to 50 times faster data distribution, quantized vectors that reduce memory usage by up to 96%, and expanded Queryable Encryption to support range queries. The release is available via MongoDB Atlas, MongoDB Enterprise Advanced, and MongoDB Community Edition.
Elevate Access Token Security by Demonstrating Proof
Bearer access tokens let anyone holding a valid token call a resource server, creating risk when tokens are stolen. Existing protections include secure coding, short expiration, and origin restrictions, but the post presents OAuth 2.0 Demonstrating Proof of Possession (DPoP) as a way to bind tokens to client-generated cryptographic proof. The client creates a JWT containing request details, issue time, unique identifier, and public key; the authorization server uses it to bind a key hash and request information to the returned token. For sensitive requests, authorization or resource servers can require a nonce, prompting a new proof and limiting lifetime and replay risk. Resource servers must validate both proof and access token properties, with a vetted OAuth library recommended.
Approaches to keep sending OTP over SMS... for now
SMS and voice OTPs remain broadly applicable for identity verification, but the post argues they should eventually be replaced because SIM swapping, phishing, uncontrolled secret-delivery channels, device-linking gaps, and slower logins weaken them. Until then, Okta will require organizations to bring their own telephony provider, using a telephony inline hook to send codes and report outcomes. The implementation can be built in-house, outsourced, or delegated to a managed service, with regional regulations, traffic peaks, reliability, branding, security, and available resources shaping the choice. A hook has three seconds to return success or failure before Okta’s heavily rate-limited failover sends the message; teams must also secure endpoints and API keys, monitor logs, and handle vendor or delivery failures.
Mastering API Gateway Integration: Salesforce, Heroku, and MuleSoft Anypoint Flex Gateway
MuleSoft Anypoint Flex Gateway provides a pattern for exposing APIs and microservices running in Heroku Private Spaces while adding API management and security controls. The tutorial deploys an internal Heroku application, creates or imports an OpenAPI 3.0 specification in Anypoint Design Center, publishes it to Exchange, registers the gateway through Runtime Manager, and deploys it in the same Private Space. That placement lets internal-routing applications receive public traffic through the gateway while routing access through a centrally configured layer managed with MuleSoft and Heroku. It then applies a Client ID Enforcement policy in API Manager, showing that requests with incorrect credentials fail and requests using the issued Client ID and Client Secret can authenticate. The pattern is presented as a foundation for Heroku and Salesforce multi-cloud integrations.
Okta at RSA Conference 2024
Okta’s RSA Conference 2024 presence includes a May 7th session on identity as a defense against breaches and a booth featuring the Shared Signals Framework (SSF) and Universal Logout. Attackers can exploit weak passwords, phishing credentials, and privileged access, while applications may lack the cross-service context needed to identify suspicious account behavior. SSF, developed by the OpenID Foundation, enables software to send and receive signals about user behavior so services can respond according to their threat models. Universal Logout lets administrators and automation end a user’s existing sessions with an identity provider, complementing SSF and intrusion detection tools; Okta’s feature was not yet released. The post points to a build-your-own endpoint, SSF resources, and a pilot program for integrators.
eBay's Responsible AI Principles
eBay sets out principles for developing and using AI-powered customer tools and services while addressing safety and community needs. Its framework covers reliability, safety, security, inclusivity, equity, fairness, accountability, lawfulness, privacy by design, and transparency. The company says it rigorously tests AI technologies, protects confidential data used to train or operate systems, includes measures to avoid excluding groups, and applies quality and safety checks to datasets. It also calls for human oversight throughout development, launch, and monitoring, risk-based decisions, regulatory compliance, and privacy-focused design using state-of-the-art methods. For users, eBay says transparency may involve disclosures within an experience or broader communication, depending on lifecycle stage and the audience.
The End of Third
The post explains how browser phaseouts of third-party cookies can affect Okta authentication patterns and session features. Third-party cookies are issued by other domains and can support cross-site session introspection, federated login-related behavior, and convenience features, but browsers increasingly restrict them because of security and privacy concerns. Most Okta core authentication flows do not require them; however, applications using an Okta session across different top-level domains, customer-hosted sign-in experiences, ADSSO, and certain “remember me” functions may lose session introspection or extension while basic authentication and token return remain possible. The post recommends testing with Chrome’s third-party cookies disabled, using feature flags, and migrating away from these cookies before Google’s stated exemption ends in 2024.
Macaroons Escalated Quickly
Fly.io built a Macaroons-based security token system after finding its API tokens too powerful for expressing scoped permissions and roles. The design starts with a user-linked, HMAC-signed bearer token and chains caveats through HMAC, while checking every caveat independently so each added restriction can only weaken authorization. It models organizations, apps, machines, and volumes with first-party caveats, and also includes third-party caveats, service-token transformations, machine locking, nonce-based revocation, and expiration handling across customer workloads. The resulting system lets users create roles without changing the platform and supports SSO, plugins, and traceable inter-service authorization, although the author acknowledges extra complexity and awkward ways to express some roles.
Finding the right balance of speed and security through just-in-time access to cloud resources
Ramp’s rapid growth exposed problems in its AWS access model: three broad roles created persistent production access for some senior engineers while junior engineers depended on seniors for queries. The team first reorganized permissions into more than 20 team-specific AWS Identity Center groups, each backed by permission sets and a Terraform module that presents IAM configuration through human-readable resource lists. It then introduced just-in-time access through ConductorOne by pairing each non-production role with an elevated production role, removing standing production access and provisioning entitlements through AWS SSO group membership. Team-owned requests were automatically approved, while cross-team requests went to the relevant tech lead, with temporary access and backup approval handling described in the design. The resulting model reduced exposure, preserved fast access to needed resources, and recorded production activity for accountability and audit purposes.
Why You Should Migrate to OAuth 2.0 From Static API Tokens
Static API tokens provide a simple way to authorize calls to protected third-party APIs, but their long lifetimes, broad permissions, and lack of user context create security and auditing risks. OAuth 2.0 addresses these limitations through a centralized authorization server that issues short-lived access tokens, which clients send in the Authorization header with the Bearer scheme. The post describes Client Credentials for service-to-service interactions and explains that scopes can distinguish permissions such as okta.users.read and okta.users.write; other configurations support task-based automation and user access through web applications. Migration guidance recommends implementing new calls with OAuth 2.0, applying least privilege, testing expiration and error handling, and securing private keys and JWKS generation before production deployment.
Tokenized Tokens
Fly.io describes a security problem in its Rails-based platform: as the application accumulated secrets, Rails became the part of the attack surface least trusted, yet still handled many operations involving bearer tokens. It compares model encryption, Vault or KMS, and narrowly scoped secret-handling services, noting that each leaves gaps or creates operational overhead when secrets must be read for arbitrary third-party APIs. The proposed Tokenizer is a stateless HTTP proxy holding a Curve25519 private key; encrypted secrets travel in Proxy-Tokenizer headers, and the proxy injects plaintext or computes HMACs while host allowlists constrain misuse. A companion SSOkenizer performs OAuth2 flows outside Rails, tokenizes resulting bearer tokens, and returns credentials usable only through Tokenizer. The tools are open source, and the design provides a path for third-party integrations and SSO without adding raw secrets to Rails.
What Does It Mean to Be Enterprise Ready: Devday23 Keynote
What makes a SaaS application ready for enterprise customers when identity is involved? This Devday23 keynote introduces enterprise readiness as a concern spanning application security, user onboarding, scalable authentication, identity, user management, and automation. Arnab Bose, Chief Product Officer for Workforce Identity Cloud at Okta, leads the presentation’s “Why” and “What” questions in a half-day virtual conference hosted at WIC Devday 23. The keynote is positioned as the opening of a series covering enterprise customer expectations, building an enterprise-ready MVP, moving beyond MVP, authentication considerations, user management, and stronger authentication mechanisms; a related “Setting the Bar for Enterprise-Grade Identity” whitepaper provides benchmarks for secure SaaS management.
SOC2: The Screenshots Will Continue Until Security Improves
Fly.io’s SOC2 certification prompts an explanation of what the audit measures, when companies should pursue it, and what security value customers should assign to it. The post characterizes SOC2 as an accounting-style audit of documented company security processes, centered on an auditor-customized Document Request List (DRL) and screenshots, rather than adversarial product testing. It distinguishes Type I’s point-in-time snapshot from Type II’s multi-month confirmation and recommends doing the engineering work early, while delaying certification until customer demand justifies it. Fly.io prepared for more than a year and describes controls including Google SSO, certificate-based SSH access through Teleport, VPN gating, GitHub SSO, and session audit logs. The resulting certification improved processes but remains a weak positive security signal: SOC2 can miss much of a company’s technical security model, so penetration tests and clear security reporting still matter.
API Tokens: A Tedious Survey
The post surveys API token schemes in the context of designing fine-grained permissions for Fly.io’s control-plane API, which currently provides all-or-nothing root credentials. It compares simple random tokens, platform tokens, OAuth 2.0, and other formats and protocols against revocation, database access, and vulnerability concerns, while distinguishing end-user API security from inter-service authentication and federated identity. The discussion explains how stateless signed tokens trade database lookups for cache-consistency and revocation problems, then presents Macaroons as a scheme the team plans to adopt, while noting that their expressiveness may be excessive for typical CRUD applications. Biscuits extend that model with public-key signatures and Protocol Buffers-encoded Datalog programs, offering unusually explicit authorization rules but demanding a potentially wholesale commitment to token-based policy. The conclusion favors simple random tokens for many CRUD applications, chooses Macaroons for the planned system, and advises against JWT.
Health matters: Store and process healthcare data in a HIPAA-compliant manner using Intercom
Intercom announces that it has completed a HIPAA attestation examination covering how it stores and processes health-related data, including protected health information (PHI) and electronic protected health information (ePHI). The examination was performed by an independent Certified Public Accounting firm, which reviewed HIPAA policies, procedures, and controls against the HIPAA Security Rule and HITECH Breach Notification Rule requirements. Intercom says the result allows it to enter Business Associate Agreements with applicable healthcare customers and make the attestation report available for review. Reported customer metrics include a 90% median CSAT score, 36% automatic resolution of common healthcare questions, and more than 500k healthcare conversations powered daily. Intercom also says it will perform the examination annually, alongside its stated ISO:27001 certification, SOC 2 Type 2 compliance, GDPR and CCPA compliance.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.