security

The new sandbox.credentials setting in Claude Code v2.1.187 denies reads of credential files and unsets secret env vars before sandboxed Bash commands run. Here is why the default read policy was a hole, and how to close it.

A protected endpoint returning 405 instead of 401 almost always means routing rejected the HTTP verb before auth ran, or a cookie scheme stole the challenge. Here is how to tell which.

A valid token that still 401s almost always means the bearer handler never ran or ran under the wrong scheme. Check middleware order, the default scheme, the scheme name, and whether the header even reached the handler.

Wire the Agent Governance Toolkit into a Microsoft Agent Framework 1.0 agent so every tool call is checked against a YAML policy and written to a tamper-evident audit trail. Full C# middleware, policy file, and a hash-chained audit sink.

A complete guide to TokenValidationParameters in ASP.NET Core 11: how ValidateIssuer, ValidateAudience, and ValidateLifetime work, what the defaults actually are, why Authority auto-configures the issuer and signing keys, the 5-minute ClockSkew trap, and how to read the IDX error codes when a valid-looking token is rejected.

A complete guide to CORS for a bearer-token API in ASP.NET Core 11: the correct UseCors ordering relative to authentication, why a bearer token in the Authorization header is not a CORS credential, why AllowAnyHeader works but a manual wildcard does not cover Authorization, and how to keep preflight from failing.

.NET 11 Preview 5 adds a first-class X25519DiffieHellman type to System.Security.Cryptography, so you can do Curve25519 key exchange without BouncyCastle or NSec.

Anthropic shipped a free security-guidance plugin for Claude Code that scans the agent's own edits for vulnerabilities in three layers, from a no-cost pattern match to an agentic review on commit.

NuGet Package Pruning shipped on-by-default for net10.0 projects, cutting transitive vulnerability reports by 70% and restore times by up to 50%.

Microsoft's new Microsoft.AgentGovernance package wraps MCP tool calls with a policy kernel, a security scanner, and a response sanitizer. Here is what each piece does and how the wiring looks in C#.