Securing non-human identities: automated revocation, OAuth, and scoped permissions
2026-04-28T07:24:05Z•dc653e7083137f9d1e6e7a177f3984fee4f775101228c6fa22a1453671bb441b
RFC-9728account-abuseacmeacme-validationai-securityapi-tokenscgnatclient-side-securitycloudflareddosleast-privilegelog-explorermanaged-oauthmcpoauthpingorapost-quantumpqcryptoradarrequest-smugglingresource-scoped-permissionsshadow-mcpvulnerability-scannerworkers-vpc
What happened
A batch of Cloudflare security updates and product launches focused on tightening developer and application security: scannable API tokens, GA resource-scoped permissions and tools to enforce least-privilege; enhanced OAuth visibility and Managed OAuth for Access (RFC 9728) to let agents authenticate without insecure service accounts; new protections for detecting and governing MCP/Shadow MCP and token cost reductions (Code Mode). Cloudflare also announced a moved target for full post-quantum deployment to 2029, opened advanced Client-Side Security and AI Security for Apps to all users, and 출시
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- dc653e7083137f9d1e6e7a177f3984fee4f775101228c6fa22a1453671bb441b
- Enrichment time
- 2026-04-28T07:24:05Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.