Start Debugging

security

53 posts · Page 2 of 6

2026-10-09 dotnet semantic-kernel ai-agents

Semantic Kernel 1.81 Stops FileIOPlugin From Leaking Files Outside AllowedFolders

Semantic Kernel .NET 1.81.0 fixes a FileIOPlugin oracle: WriteAsync told the model a file outside AllowedFolders existed, was read-only, and where it lived. Measured before and after.

2026-09-27 ai-agents claude-code security

How to Run a Coding Agent in a Disposable VM or Container Instead of on Your Laptop

Dev containers, Docker Sandboxes microVMs, Lima VMs, and hosted cloud sandboxes all move Claude Code, Codex, or Copilot CLI off your host. What each one actually isolates, the exact commands to make it throwaway, and the two things none of them protect: your writable workspace and your git hooks.

2026-09-25 ai-agents claude-code mcp

How to Keep API Keys Out of a Coding Agent's Context With a Credential Gateway

Scoping a token does not stop a prompt-injected agent from leaking it. Moving the token out of the agent's process does. Three working setups: a 50-line gateway any agent can call, Claude Code 2.1.199+ sandbox masking with injectHosts, and Claude Managed Agents vaults, plus the measured leak that host-level injection still allows.

2026-09-24 nuget dotnet security

Microsoft Is Rotating Its NuGet Author-Signing Certificate: Fix trustedSigners Before NU3034 Hits

Starting September 23, 2026, Microsoft packages on NuGet get author-signed with a new certificate (SHA-256 9A1B131B...). If your nuget.config pins Microsoft in trustedSigners, restores will fail with NU3034. Here is the fix, including the correct dotnet nuget trust command.

2026-09-22 flutter dart webview

How to block a Flutter WebView from navigating to external URLs with NavigationDelegate

Keep a Flutter WebView on your own domain with webview_flutter 4.14.1: parse the URL, compare Uri.host instead of startsWith, hand mailto: and tel: to url_launcher, and know what Android and iOS actually send to onNavigationRequest.

2026-09-22 aspnetcore dotnet-11 minimal-apis

How to disable antiforgery validation for a single minimal API form endpoint in ASP.NET Core 11

Call .DisableAntiforgery() on the one endpoint, or on a MapGroup. In ASP.NET Core 11 that opts out of both the token middleware and the new automatic CSRF check. Measured matrix, precedence traps, and narrower alternatives.

2026-09-19 messagepack security signalr

MessagePack 3.1.9 and 2.5.303 Fix a 32 KiB Payload That Allocates 120 MiB

CVE-2026-92707: nested MessagePack array headers could reuse the same trailing bytes to pass the length check, so deserializing into object allocated thousands of times the payload size. The fix, a before/after probe, and why SignalR apps on .NET 8 through 11 RC 1 need a direct package pin.

2026-09-16 errors github-copilot ai-agents

Fix: GitHub Copilot can't see a file because a content exclusion rule excludes it

"File is configured to be ignored by Copilot" or "Some files were excluded from the context" means a content exclusion rule matched. How to find the rule, why globs over-match, and how to narrow it.

2026-09-13 microsoft-agent-framework dotnet ai-agents

Agent Framework 1.21: LocalCodeAct Stops Handing Your Host Environment to Model-Written Python

Microsoft Agent Framework .NET 1.21.0 ships Microsoft.Agents.AI.LocalCodeAct 1.21.0-preview.260911.1, which no longer lets the CodeAct Python subprocess inherit the parent environment when Environment is null. On 1.20, generated code could read every host variable, API keys included.

2026-09-04 dotnet native-aot jit

What is the W^X flag in .NET and does Native AOT need it?

W^X (write xor execute) is the rule that no memory page is writable and executable at the same time. In .NET it is the DOTNET_EnableWriteXorExecute knob, on by default since .NET 7, and it exists entirely for the JIT. Native AOT never reads it. Here is how the runtime implements it, what it costs, and when turning it off is a legitimate fix.