Shopify Mandates IP Allowlisting for Public Apps to Prevent Unauthorized Admin API Access
Developers must enable IP allowlisting by November 20, 2026, or face App Store removal for public apps calling Admin API.
Stories per day · 30 days
6 stories, newest first · one card per story
Stories tagged #token-security
How to keep AI agents within their permissions
Token Security explains how to stop AI agents from using credentials outside their assigned tasks.
5
AI's Third Wave: Coworkers Break the Security Model That Worked for Agents
Token Security says persistent AI coworkers will hold standing privileges that break human-centric OAuth and audit models.
4
AI agent authorization risks remain a gap in new NIST-CISA token security guidance
NIST and CISA release IR 8587 guidance on securing signed tokens, but AI agent authorization and delegation risks remain out of scope.
NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery
NIST released IR 8587 giving agencies and cloud providers recommendations to prevent identity token forgery, theft, and misuse in SSO and API environments.
1
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.
3