OAuth

The Vercel breach: OAuth attack exposes risk in platform environment variables

Attackers exploited a compromised Google Workspace OAuth app (Context.ai) to gain access to Vercel customer environment variables and secrets, demonstrating how trusted OAuth integrations become supply-chain backdoors.

App host Vercel confirms security incident, says customer data was stolen via breach at Context AI

ShinyHunters compromised Vercel by injecting a malicious Context AI app into an employee's OAuth-authorized Google account, exfiltrating API keys and customer source code now being sold on cybercriminal forums.

Vercel breach exposes the OAuth gap most security teams cannot detect, scope or contain

Vercel's breach exposed a critical blind spot: most security teams lack visibility and controls to detect OAuth-based supply-chain attacks, leaving infrastructure broadly vulnerable.

Some secret management belongs in your HTTP proxy

HTTP proxies inject API credentials at the transport layer, letting AI agents operate securely without being exposed to raw keys or forcing applications into detection evasion.

Securing non-human identities: automated revocation, OAuth, and scoped permissions

Cloudflare ships identity security features (scannable tokens, scoped RBAC) for AI agents and scripts, addressing OWASP gaps as agentic workloads proliferate.