Securing non-human identities: automated revocation, OAuth, and scoped permissions
2026-04-18T19:24:16Z•f285111a34cdc17e6f95fd2cebfdbbfab0fbbf78ab5582c502565ce95155d07b
account-abuse-protectionacmeacme-validationai-for-appsai-securityapi-tokensclient-side-securitycloudflareddos-reportfixleast-privilegelog-explorermanaged-oauthoauthpatchpingorapost-quantumpq-cryptographyradar-2025-year-in-review','workers-vpc','mcp','ai-gateway','shrequest-smugglingresource-scoped-permissionsrfc9728scannable-tokenssecurityvulnerability-scanner
What happened
Cloudflare published a set of security-focused product updates, disclosures, and research: scannable API tokens, enhanced OAuth visibility and Managed OAuth (RFC 9728) for agent-friendly authentication, GA for resource-scoped permissions to enable least-privilege architectures, and tooling to cut token costs and detect Shadow MCP. They announced a target of 2029 for full post-quantum deployment, opened advanced client-side security detections to all users, launched Account Abuse Protection (Early Access), and made AI Security for Apps generally available with free AI discovery. Observability/d
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- f285111a34cdc17e6f95fd2cebfdbbfab0fbbf78ab5582c502565ce95155d07b
- Enrichment time
- 2026-04-18T19:24:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.