Securing non-human identities: automated revocation, OAuth, and scoped permissions
2026-04-29T19:24:11Z•96603855134dff37104faf9b29be3cd65ad3ae6fcfca0180a64d6183a9acedbd
account-abuseacmeai-securityapi-tokenscgnatclient-side-securitycloudflareddoslog-explorermcpoauthpingorapost-quantumrequest-smugglingresource-scoped-permissionsrfc9728shadow-mcpvulnerability-scannerworkers-vpc
What happened
A batch of Cloudflare security blog posts announcing product features, research, and vulnerability disclosures. Key highlights: scannable API tokens, improved OAuth visibility and Managed OAuth (RFC 9728) for agent-friendly authentication, GA for resource-scoped permissions to enable least-privilege, and new MCP governance/Code Mode guidance. Cloudflare moved its full post‑quantum security target to 2029 and published expanded PQ monitoring in Radar. Security product launches and upgrades include Client‑Side Security (cascading AI detection), AI Security for Apps (GA), Account Abuse Protection
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- 96603855134dff37104faf9b29be3cd65ad3ae6fcfca0180a64d6183a9acedbd
- Enrichment time
- 2026-04-29T19:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.