OAuth scope mistake in calendar integrations

By now I learned of the fourth large consultancy selling my open source (CC BY 4.0) PQC Migration Framework as their proprietary methodology. (And even charging for it tens of thousands of dollars.) This is unethical and unprofessional. And I will start naming these companies publicly if this continues. Open-source security frameworks produce better outcomes than proprietary ones. The PQC Migration Framework proves it. When I published the framework under Creative Commons, the feedback loop accelerated. Organizations across sectors adapted the methodology and shared what they learned. The sector-specific extensions for digital assets, healthcare, and telecommunications came from practitioners who used v1.0 and identified what was missing. The whole industry gets better outcomes if we adhere to the model. I am not promoting my framework here, and not claiming it is the best one out there, but if you decide to use it, you have to adhere to CC BY 4.0 license - which means you can use it even commercially if you want to, but you have to keep the attribution. The methodology is free at pqcframework.com . https://lnkd.in/eHh8Mg4w #OpenSource #PQC #CyberSecurity #CreativeCommons #PQCMigration #Community #PostQuantum

brand vs open source... many times what we find, what we create, what we think should be kept in box locked.. no charity.. Nicolas Tesla and Russel Walter are the two great examples ....

Attackers are goal oriented. Trade secrets, customer data, or just knocking your business offline. Your APIs are usually the front door. This guide covers what solid API security actually looks like.

JWT Compromise: When Stateless Authentication Meets Real-World Threats A hacker steals your JWT token and you immediately click logout. But the hacker can still access your system. How do you solve this? 🚨 The Core Problem: Stateless Vulnerability The fundamental issue is that JWTs are completely stateless. When a JWT is issued, the server doesn't store it anywhere. Instead, it simply verifies the token's cryptographic signature and expiration time on every incoming request. Because of this design, even if you log out, the stolen JWT remains fully valid until its expiration timestamp passes. This is why a client-side logout alone completely fails to invalidate an already-issued token—the server remains entirely unaware that the user intended to end the session. Solving logout with JWTs is never as simple as deleting a token from the browser. 🛠️ Production-Ready Solutions To fix this security gap, modern systems introduce a controlled element of state back into the architecture. Here are the four most common solutions: ⏱️ Short-Lived Access Tokens (5–15 Minutes) Even if a token is stolen, its lifetime is highly restricted. This drastically minimizes the hacker's window of opportunity. 🔄 Refresh Tokens You issue a long-lived refresh token alongside the access token. You store these refresh tokens securely in your database and instantly revoke them during a logout event. 🚫 Token Blacklisting When a user logs out, you add the compromised JWT's unique identifier to a fast, in-memory blacklist (like Redis). The server checks this blacklist before processing any incoming requests. 🔢 Token Versioning You store a token_version integer in your database for each user and embed it into the JWT payload. When a user logs out or changes their password, you increment that version. Any older JWT carrying the previous version is instantly rejected. 💡 The Industry Standard Approach In production environments, the most optimal architecture relies on: Access Token + Refresh Token + Refresh Token This exact combination delivers the best of both worlds. It provides incredible scalability by keeping standard requests completely stateless, while preserving robust security by giving you the absolute power to kill a compromised session the second a user clicks logout. #JWT #SystemSecurity #Software #SystemDesign #BackendDevelopment

The latest update for #Veracode includes "#CISO Executive Briefing: Supply Chain Front-End Compromises and Sustained Third-Party Risk Elevation" and "Security Debt Management Requires a Board-Level Conversation: Here's How to Own It". #cybersecurity #AppSec #DevSecOps https://lnkd.in/dWV7H7G

n8n, a workflow automation platform used by businesses to connect apps and automate tasks, shipped a fix on June 24 for a flaw that let someone log in as another user without knowing their password. The bug affected Enterprise deployments where two or more external login systems were trusted at once — the platform matched incoming login tokens on only half the required identifier, so a valid token from one system could unlock a different user's account. No confirmed attacks have been reported, but the fix did not appear in the release notes, only in the security advisory. Any business running n8n Enterprise below version 2.27.4 or 2.28.0 should update to 2.27.4, 2.28.1, or the current stable build immediately. ☠️ #CyberNewsLive https://lnkd.in/giBVdTzD

An MCP gateway was breached last month. 10,000 customer API keys and OAuth tokens exfiltrated. Not because the customers were compromised. Because the gateway holding their credentials was. This is the part of the agentic stack that doesn't get enough scrutiny. When you connect your tools through a third-party MCP gateway, you're not just routing traffic. You're placing credentials on someone else's infrastructure and trusting that their security posture is as strong as yours needs to be. When it isn't, the blast radius isn't theirs. It's every system that trusted them. There's an architecture where credentials never leave your environment. Where the gateway can authorize actions without holding the keys to execute them. Where a breach of the integration layer doesn't become a breach of everything connected to it. That architecture exists. Most teams aren't using it. Most vendors aren't offering it. This won't be the last incident.

Signature verified. You're still wide open. Signature verification tells you one thing: the payload wasn't tampered with in transit. It tells you nothing about: 🔴 Replay attacks → same signed payload resent hours or days later 🔴 Timestamp staleness → stale events accepted without freshness check 🔴 Idempotency failures → same event processed twice, action executed twice 🔴 Source verification gaps → IP allowlisting not configured where available 🔴 Object-level authorization → signed event acting on resources it shouldn't own 🔴 Missing webhook inventory → undocumented endpoints, unrotated signing keys 🔴 Insufficient observability → no alerting on anomalous webhook patterns 48% of breaches involve a third party. Webhooks are exactly in that seam. 10-minute self-audit + full remediation guide: https://lnkd.in/eM--NqKb

The latest update for #Veracode includes "Cyber Risk Intelligence Brief: #SupplyChain Trust Erosion and Ransomware Velocity Require Preventive Control Discipline" and "Erasing Security Debt with an App Risk Remediation Platform". #cybersecurity #AppSec #DevSecOps https://lnkd.in/dWV7H7G