Cybersecurity / News analysis
npm lets trusted publishers manage release tags without long-lived tokens
The new opt-in permission closes a gap in token-free release workflows, but the authority to move a release tag still needs deliberate limits.
THE TOPIC FILE
Digital identity
Authentication establishes who is asking; authorization determines what they can do. Read our coverage of passkeys, recovery, sessions and permissions across personal and enterprise systems.
Stories in this collection
Companies / News analysis
Cloudflare opens a beta for paid agent access using HTTP 402
The payment gateway gives participating services a way to charge automated clients per request, creating new requirements for budgets and authorization.
Cybersecurity / News analysis
GitHub adds repository-level runner selection for Dependabot
Private and internal repositories gain more control over where dependency-update jobs execute, including access to specialized environments and private registries.
Cybersecurity / News analysis
GitHub Enterprise adds a consolidated credential inventory export
A new export brings credential metadata into one view, helping security teams examine access paths while keeping inventory, evidence of use and revocation distinct.
Data Breaches / Explainer
What stolen session tokens change about account security
A successful login creates ongoing authority. Protecting that authority requires controls that extend beyond passwords and the moment of multifactor authentication.
Cybersecurity / Explainer
Zero trust starts with the resource someone wants to reach
The useful design question is who may perform which action on which resource, under what conditions. Network location supplies context, not automatic permission.
Data Breaches / Analysis
Why cloud breaches often start with identity
Cloud services can faithfully enforce the wrong permissions. The critical question is which identities can reach data, delegate access, and change the rules.
Cybersecurity / Analysis
Passkeys change the login. Recovery decides the risk.
Phishing-resistant sign-in is a major improvement. The harder design work begins when a person loses the devices and accounts that hold their credentials.