#security
security

A secure enterprise chat with React, .NET 10 and Microsoft Foundry

The article targets the common mistake of calling the model straight from the front end with the API key in JavaScript, and instead wires React to a .NET 10 Minimal API that talks to Microsoft Foundry without any keys. It walks through Entra ID authentication, a server-owned system prompt, Server-Sent Events streaming and IP-based rate limiting as the protections that separate a demo from a product.

ASP.NET Core Authentication & Authorization Explained: What to Use, When, and How to Ship It Safely

A long, practical walkthrough of ASP.NET Core authentication and authorization on .NET 10: which mechanism fits which caller, where teams leave holes such as missing resource-level checks, and what to verify before going to production.

Mastering Rate Limiting and Resource Governance for MCP Servers at Scale

A production write-up on rate limiting and resource governance for MCP orchestration servers, where a single tenant's burst can exhaust shared LLM token quota and starve everyone else. It compares the common limiter algorithms and lands on per-tenant token buckets with Redis-backed state and quota-aware refill rates.

Faking a Yes: 6 Attacks on the Human Confirmation in a .NET 10 MCP Server

A developer red-teamed the confirmation step of a refund MCP server built on ASP.NET Core with the official C# SDK (ModelContextProtocol 2.3.0). Six attacks — plain-JSON requestState, replaying another user's approval, injected form fields and a pre-checked consent box — each led to a concrete server-side defense, plus a checklist you can apply to your own tools.

.NET 8 and 9 End of Support: A Deployment-First Migration Checklist

Microsoft retires .NET 8 and .NET 9 on November 10, 2026, leaving apps without security patches unless they move to .NET 10. A new deployment-first checklist shows how to inventory what is actually running, retarget with minimal risk and prove the migration with artifact-level testing and a rollback rehearsal.

Securing APIs with Microsoft Entra ID: scope, client and token validation

A practical guide to protecting an API with Microsoft Entra ID: registering the API, exposing a scope, and registering the client that requests it. It walks through a .NET Core API using Microsoft.Identity.Web, a React client using MSAL, and a .NET web app calling a downstream API. The same token checks apply to any backend stack.

Backdoor found in Claude Code VS Code extension on Cursor Marketplace

Phorion found a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code VS Code extension on the Cursor Marketplace. Cursor has removed both versions. Developers and teams who installed the extension should check their machines now, since the payload runs as soon as the extension loads.

Six checks an AI Telegram assistant needs before the model runs

A developer built a Telegram assistant in n8n that can send email and book meetings, with its decisions guarded by a small ASP.NET Core API on .NET 10. The post lists six checks that run before the model sees a request: chat allowlist, duplicate updates, stale messages, voice length, contact ambiguity and time zones. It is a useful checklist for any bot that triggers side effects.

Publish Visual Studio Marketplace extensions securely with Trusted Publishing

Visual Studio Marketplace now offers Trusted Publishing, which lets VS Code and Visual Studio extensions be published from GitHub Actions or Azure Pipelines without a long-lived personal access token. Publishing uses federated identity instead, so there is no secret to store or rotate. Extension authors who automate releases should review the setup and migration steps.

Security extension for the GitHub Copilot app is in preview

The new GitHub security extension for the GitHub Copilot app lets you browse code scanning alerts, ask Copilot to explain or fix them, and run a security review on local changes without leaving the app. It is in public preview. Developers who already rely on code scanning will find it a faster way to handle alerts.

Azure SDK October 2026: Azure Core, managed identity and Cosmos DB for Rust 1.0.0

The October 2026 Azure SDK release highlights Azure Core 1.63.0 for .NET, Identity updates for Python and Java, and the first stable Cosmos DB for Rust 1.0.0. The authentication changes affect how DefaultAzureCredential behaves in production. Teams on the Cosmos DB Rust preview also get concrete upgrade steps.

SQL Server Always Encrypted: How Secure Enclaves Change Query Support

Always Encrypted encrypts SQL Server columns on the client, so the database engine never sees their plaintext. Secure enclaves can run some otherwise blocked query operations inside a protected environment. The article walks through choosing an encryption type, defining the column and configuring a .NET client.