Blog — Field notes on identity security

The blog 01

Field notes from the identity frontier.

Breach teardowns, threat research and product dispatches from the team stopping identity attacks in production — written for the people who get paged.

Latest dispatch

Security·Jul 30, 2026

Breaking MCP at the Identity Layer

Part 1 attacked the MCP server itself. This part assumes all of that is patched and breaks in through the identity layer instead — where nothing is a bug you can close, and the server does exactly what it was told by the wrong person. We walk the 2026-07-28 authorization spec and the RFCs behind it, the confused-deputy attack that comes from getting consent wrong, how EMA and ID-JAG move consent to the IdP — and the four gaps that remain open afterwards, where every token is valid and nothing in the OAuth stack fires.

SlashID Team
Threat Intelligence

Read the analysis →

// security · Jul 30, 2026

65 dispatches

Field notes from the identity frontier.

Breaking MCP at the Identity Layer

When the MCP Server Is the Payload: Attacking MCP at the Implementation Layer

The Illicit Consent Grant Part 2: Device-Code Phishing and the AI PhaaS Wave

The Illicit Consent Grant Part 1: Understanding Modern OAuth Consent Phishing

Analysis of the 2026 Stryker Breach: Weaponizing Cloud Endpoint Management

Vercel April 2026 Security Incident: How a Compromised OAuth App Led to a Major Breach

Deepfake Impersonation Attacks (Part 2): Defending with SlashID Mutual TOTP

Deepfake Impersonation Attacks (Part 1): Anatomy of Modern Deepfakes

NYDFS 2026 Vishing Advisory: Detection and Defense with SlashID

Scattered Spider Tradecraft: Identity Abuse, Attack Flow, and Defense

Microsoft Actor Token Forgery

Access tokens strike again, the Salesloft Drift breach

Illicit Consent-Granting & App Backdooring – Obtaining persistence in Entra

Achieving Least Privilege: Unused Entitlement Removal

Protecting against malicious OAuth 2.0 applications

Navigating PCI DSS 4.0: The Challenge of Non-Human Identities

Identity Security: The problem(s) with federation

Non-Human Identities Security: Breaking down the problem

Detecting Man-in-the-Middle Attacks with SlashID

A deep dive in the AWS credential leaks reported by Palo Alto Networks

SlashID RBAC: Globally-available role-based access control

Protecting against Snowflake breaches

Introducing the SlashID Local Deployment

ODPR: A Framework for Securing Non-Human Identities

Credential Tokenization: Protecting third-party API credentials

Secure API and M2M Access with OAuth2 Client Credentials and SlashID's sidecar

Introducing Organization Attributes

Introducing Anonymous Users: Balancing First-Party Data Collection and User Experience

SlashID SDK for PHP and Laravel authentication

Adding custom claims to identity tokens

SlashID: Building a globally distributed Identity Platform

Passkeys Adoption Trends: Survey from Large Deployments

Single Sign-On implementation: Safely retrieving the email claim

Single Sign-On implementation: Security Issues and Best Practices

Introducing the SlashID Remix SDK: Authentication made easy

Firebase Authentication and Google Identity Platform User Enumeration Vulnerability

GDPR Compliance: Consent Management

OAuth 2.0 Fine-Grained API Authorization with Gate and OpenAPI

Rate Limiting for Large-scale, Distributed Applications and APIs Using GCRA

Context-aware authentication: fight identity fraud and qualify your users

Backend Authentication and Authorization Patterns: Benefits and Pitfalls of Each

JWT Implementation Pitfalls, Security Threats, and Our Approach to Mitigate Them

No-code anti-phishing protection of internal apps with Passkeys

Firewalling OpenAI APIs: Data loss prevention and identity access control

Ditch your organizations table

Protecting Exposed APIs: Avoid Data Leaks with SlashID Gate and OPA

Docusaurus - Authentication and authorization with SlashID

Authenticate your Shopify customers with SlashID

Synchronous Webhooks

Building a React Login Page Template

SlashID Analytics Webhooks

Passkeys - Threat modeling and implementation considerations

Authentication flows with SlashID

Using Google Tink to sign JWTs with ECDSA

React SDK support for <Groups>

Sign-in and Sign-up React component release

Fetching Google Groups with SlashID SSO

In-browser HSM-backed Encryption with Tink and Wasm

Official React SDK release

Adding Identity to Docusaurus

Introducing Data Vault - Secure HSM-backed PII storage directly from the frontend

Social logins in 5 minutes or less

App-layer cryptographic primitives for secure storage of user data

The good, the bad and the ugly of Apple Passkeys

The Security and Regulatory Compliance Benefits of WebAuthn

Phishing Attacks – WebAuthn to the rescue

Get the dispatch in your inbox.