oauth
4 posts
Article
One bearer token, replayed from a residential proxy
How attackers abuse OAuth 2.0 at scale via consent phishing, device code flow, and service principal credentials - and why endpoint EDR sees none of it.
Article
Cloudflare's self-managed OAuth secures nothing by default
Cloudflare's self-managed OAuth moves the enforcement point from provider to user. An unconfigured access control is an open path, not a safe default.
Article
There is no Linear kernel CVE
Linear's speed comes from a local-first sync engine, not a kernel-memory exploit. The fabricated CVE framing is wrong. The real exposure is elsewhere.
Article
OAuth ate your secrets
The Vercel OAuth breach shows environment variables are not protected by location, only by the identity assertion placed in front of them.