Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Search
Search results for “Northflank secret rotation”
Find published research by company, product, platform or technology.
Showing 21–40 of 65 dossiers
GitHub’s OAuth apps get short-lived tokens, multiple callbacks — and a wildcard setting worth auditing
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
Coolify 4.5.3 repairs access controls, deployment healthchecks and retry hazards after 4.5 launch
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
Cloudflare tests post-quantum regional key fencing — but CDN protection is not ready yet
PQ GeoKey Manager uses hybrid cryptography, regional root keys and fail-closed key unwrapping. General availability is planned for Q1 2027; CDN integration and independent assurance remain outstanding.
Adobe ships an emergency hotfix for an actively exploited Magento RCE affecting current 2.4.x lines
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
Vercel KMS lets Functions sign JWTs without holding private keys
Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
Google Cloud extends Agent Identity into Cloud Run with automatic Agent Registry registration
Agent Identity is moving from a standalone credential boundary into a mainstream serverless runtime. Cloud Run can now assign agent identities and register agents/MCP servers automatically, reducing custom discovery and identity plumbing while keeping the runtime integration itself in Preview.
Umami 3.4.1 urges self-hosters to patch Next.js RCE and MCP OAuth leakage
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
Kubernetes 1.37 moves more cluster operations into the core platform
The release consolidates several recurring cluster-management jobs into core APIs and controllers. HPA scale-to-zero is now default-on Beta, storage-version migration and Pod Certificates are Stable, DRA can satisfy existing extended-resource requests, and large etcd reads gain a streaming path that reduces peak memory pressure.
X Numbers turn a closed XChat inbox into a revocable contact channel
XChat now has a second address layer beyond the public @handle: a shareable, revocable code that can grant direct inbox access without opening message requests to everyone.
GitHub CLI’s Linux package signing key expires September 5
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
Sentry’s February 2027 TLS issuer switch will break pinned and some legacy clients
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
GitHub adds three webhook IP ranges — static firewall allowlists need updating
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsAI CodingDeployment & DevOpsDeveloper ToolsActive dossier
Docker turns coding-agent sandboxes into movable cloud compute — and packages their authority as OCI
Docker’s new agent stack combines pay-as-you-go microVM sandboxes with an OCI-based Kit format for declaring what an agent can use. Cloud sessions cost from $0.07 to $1.12 an hour, and Docker says it plans to take the Kit specification toward CNCF neutral governance.
GitHub AI Scan no longer needs CodeQL default setup
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
Dependabot’s private GitHub Packages access is back — now as fallback authentication
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
Cloud SQL regional API endpoints are now GA across MySQL, PostgreSQL and SQL Server
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
Kiro makes coding-agent sessions portable across the IDE, CLI, web and mobile
The workflow shift is continuity rather than another model upgrade: one Kiro agent session can outlive the laptop that started it. Cloud configuration can also carry agent setup across environments, although enterprise governance is not identical between local and web/cloud surfaces.
Google DeepMind is piloting double-blind frontier-model evaluations with confidential computing
The pilot attacks a persistent evaluation trade-off: labs do not want to reveal frontier-model internals, while evaluators do not want benchmark prompts leaking back to the model provider. DeepMind says a Singapore AI Safety Institute pilot kept both sides’ sensitive assets hidden during execution.
GitHub Copilot turns Slack and Teams conversations into shared coding-agent sessions
GitHub Copilot can now turn Slack or Teams threads into collaborative cloud-agent sessions. Teammates can add context and steer the work in public, while repository permissions, agent budgets and optional extra PR approvals remain the main control boundaries.