#oauth
Tagged “oauth”
3 articlesThe CrowdSec leak is a lesson in the OAuth token you forgot to revoke
About 170 private CrowdSec repositories were cloned after the TanStack npm compromise scraped an OAuth token still bound to a former employee's account, per a DevOps.com report. The pivot vector was an OAuth-app grant nobody had audited.
Sep 24, 2026 · Tomás VegaSecurity & supply chainVault wants your AI agents to ask permission, one request at a time
HashiCorp Vault Enterprise has put a new authorization model for AI agents into public preview, built on OAuth 2.0 Rich Authorization Requests so agents must declare what they want on every call instead of inheriting long-lived secrets. For pipelines that now host coding agents, it changes who is allowed to do what at runtime.
Jun 27, 2026 · Tomás VegaIncident responseGitHub ships a one-click self-revoke for users whose credentials just leaked
An individual GitHub Enterprise member can now wipe every credential they own, personal access tokens, SSH keys, OAuth tokens and SSO authorizations, in a single action from the Settings page. Containment used to be a scavenger hunt across four menus.
Jun 25, 2026 · Tomás Vega