X Numbers turn a closed XChat inbox into a revocable contact channel
XChat now has a second address layer beyond the public @handle: a shareable, revocable code that can grant direct inbox access without opening message requests to everyone.
Search
Search results for “identity and access management”
Find published research by company, product, platform or technology.
Showing 241–260 of 558 dossiers
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
TRACE gives AI agents a portable, hardware-attested runtime evidence format
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.
Chrome 152 lets websites put the browser behind a network allowlist
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
Gmail launches a verified political-sender deliverability program with a 0.3% spam-rate ceiling
The new program creates a specialized Gmail deliverability path for verified political senders, but it is not an inbox guarantee: recipients can still mark mail as spam, block senders or unsubscribe, and non-compliant domains can be suspended or removed.
A maintainer’s infected Mac pushed XCSSET into legitimate Flutter packages on pub.dev
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
Keycloak patches a critical password-reset flaw that can let unauthenticated attackers take over any account
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
Paddle brings recurring Pix payments to SaaS subscriptions in Brazil
Brazilian customers can authorize Pix Automático mandates for Paddle subscriptions without a separate early-access application. The path broadens local-payment access for SaaS, while delayed renewals, fixed mandate amounts and re-authorisation requirements still create implementation caveats.
Amazon joins YouTube Shopping so creators can tag products instead of relying on description links
The integration brings Amazon’s catalog into YouTube’s native shopping layer. It reduces the gap between product recommendation and purchase compared with description links, but access currently requires both YouTube and Amazon affiliate eligibility and is still limited to a select group of creators.
pgx-bm25 1.0 brings ranked full-text search into PostgreSQL's index layer
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
beehiiv gives publishers edge-enforced control over individual AI crawlers
beehiiv has moved AI crawler policy from a voluntary robots.txt signal to an enforceable publisher control for Max and Enterprise custom-domain sites. Its new dashboard tracks 22 AI and search crawlers, while separate structured-data and llms.txt features target AI discovery rather than access control.
Vercel KMS lets Functions sign JWTs without holding private keys
Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel.
OpenShot 4.1 adds a headless video-editing CLI that agents can drive — but it is experimental
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
Paddle opens billing operations to coding agents — usage-based billing remains a 2027 preview
Small SaaS teams can now move supported Paddle setup and billing tasks into Claude Code, Codex and similar agent workflows, but production account writes still require careful access control; native metered billing is not generally available.
OpenAI frontier models reach Google Cloud — with Marketplace billing against cloud commitments
Google Cloud customers gain a new route to OpenAI models with unified governance and cloud-commitment billing, but broad availability and some privacy features are still forthcoming.
Cloudflare Containers exposed previous tenants’ disk data through unzeroed blocks
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.
ChatGPT Atlas can still surface blocked URLs unless publishers use noindex
Blocking OAI-SearchBot is not a complete removal signal for ChatGPT Atlas. OpenAI says a disallowed page can still appear as a link and title when the URL is learned elsewhere and judged relevant; publishers that want to suppress that result need a crawlable noindex directive, while GPTBot remains the separate training control.
AWS Lambda can now reference deployment packages directly from your S3 bucket
AWS has added a `REFERENCE` mode for Lambda deployment packages. It eliminates duplicate managed copies, raises the default managed-storage quota to 300GB, and gives teams direct control over encryption, lifecycle and audit policy—but a deleted or inaccessible source object can now make a function inactive.
Northflank warns all customers to rotate secrets after AI keys were abused in October breach
The affected-customer count and entry point remain unconfirmed. Revoking keys at the issuing provider matters more than simply changing a platform variable.
Artificial IntelligenceCloud & InfrastructureAI ModelsCompute & AI InfrastructureInference & APIsActive dossier
OpenAI's GPT-6.1 Sol Ultrafast tier now has public 6× Standard pricing
OpenAI's Ultrafast tier has moved beyond its GPT-5.6 preview: GPT-6.1 Sol access is broad and pricing is documented at 6× Standard.
Anthropic opens Claude watermark detection API in restricted private preview
A restricted private-preview detector changes the compliance workflow, but Claude watermarking still cannot prove authorship or reliably detect short or lightly edited passages.