Start Debugging

Tag: security

24 posts · Page 1 of 3

2026-08-15 dotnet-11 dotnet csharp

System.IO.Compression Finally Reads and Writes Encrypted ZIPs in .NET 11 Preview 7

.NET 11 Preview 7 adds password-protected ZIP entries to System.IO.Compression, with AES-256 support, options types for whole-directory operations, and one empty-file bug that is already fixed in main.

2026-08-15 mcp ai-agents llm

Safe File-Write Tools for an Agent: Preview, Confirm, Apply

A write tool that asks before it writes needs three things the MCP SDK does not give you: an approval bound to the exact diff, a precondition on the file it previewed, and an integrity-protected requestState. Verified end to end on @modelcontextprotocol/server 2.0.0 against protocol revision 2026-07-28, including the argument-swap that gets past a naive confirm.

2026-08-09 github-copilot mcp ai-agents

Copilot MCP Allowlists Land in Enterprise Managed Settings

GitHub's August 6, 2026 changelog adds allowedMcpServers and deniedMcpServers to copilot/managed-settings.json. URL and argv matchers, deny-wins precedence, and a fail-closed default the older name-based registry never had.

2026-08-04 comparison claude-code ai-agents

Auto Mode vs Manual Approval in Claude Code: What Each Mode Actually Allows Through

Manual gates every tool call on you. Auto mode gates them on a classifier with 32 built-in block rules. The mode that surprises people is neither: acceptEdits auto-approves rm, mv, and sed, not just file edits. Measured on Claude Code 2.1.123.

2026-08-04 dotnet nuget ci-cd

NuGet API Keys Get a 30-Day Cap on August 17, and Every Old Key Expires November 1

NuGet.org drops the 365-day API key option on August 17, 2026, caps new keys at 30 days, and expires every key created before that date on November 1. Here is what breaks and how to move a publish workflow to OIDC trusted publishing.

2026-08-03 errors claude-code ai-agents

Fix: "Write(src/**) is not matched by file permission checks" in Claude Code

Claude Code only consults Edit(path) and Read(path) rules. A Write(src/**) allow or deny rule is accepted and then silently ignored. Use Edit() instead.

2026-07-26 ai-agents claude-code cursor

How to Lock Down a Coding Agent's Network Egress With a Strict Host Allowlist

Claude Code, Cursor, and the GitHub Copilot coding agent all ship host allowlists for outbound traffic, and all three default to something looser than you want. The exact settings keys, a policy you can copy, and the four surfaces the allowlist does not cover.

2026-07-17 aspnetcore dotnet-11 security

ASP.NET Core 11 Preview 6 turns on automatic CSRF protection

Preview 6 rejects unsafe cross-origin browser requests by default, reading the Sec-Fetch-Site header instead of an antiforgery token. Here is what it blocks and how to opt out.

2026-07-03 cursor ai-agents security

DuneSlide: Two Cursor Bugs That Turn Prompt Injection Into Zero-Click RCE

Cato AI Labs disclosed CVE-2026-50548 and CVE-2026-50549, a pair of 9.8 CVSS flaws in Cursor's terminal sandbox. A poisoned MCP response or web result can escape the sandbox and run code. Cursor 3.0 is the fix.

2026-07-03 csharp dotnet dotnet-11

How to set up JWT bearer authentication in a minimal API in ASP.NET Core 11

A complete, working setup for JWT bearer authentication in an ASP.NET Core 11 minimal API: install the package, wire up AddAuthentication().AddJwtBearer(), issue a token, protect endpoints with RequireAuthorization, add role and claim policies, and test the whole thing with dotnet user-jwts.