Web3Sec working library

Web3Sec working libraryhttps://www.web3sec.news/blog2026-11-08T00:00:00ZRaiders / Web3Sechttps://www.web3sec.news/blog/nomad-initialization-trustNomad: when an initialized default becomes permission to process a message2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A bridge authentication failure illustrates why deployment state, default values and upgrade behavior need a single security model.

https://www.web3sec.news/blog/euler-donation-accountingEuler V1: every path that changes collateral belongs in the solvency model2026-11-08T00:00:00Z2026-11-08T00:00:00Z

The March 2023 exploit connects an omitted account-health check to liquidation incentives and multi-step accounting invariants.

https://www.web3sec.news/blog/ledger-connect-kit-publishingLedger Connect Kit: offboarding and runtime dependencies share a security boundary2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A package-publishing compromise reached applications through dynamically loaded code without changing their own repositories.

https://www.web3sec.news/blog/lastpass-vault-backupsLastPass 2022: backup access can be the production-data incident2026-11-08T00:00:00Z2026-11-08T00:00:00Z

The disclosed chain from development information to privileged endpoint compromise and stolen backups challenges narrow production boundaries.

https://www.web3sec.news/blog/okta-support-session-tokensOkta support system 2023: diagnostic files can carry live account authority2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A support-system compromise links browser synchronization, service-account access and sensitive HAR files to session hijacking.

https://www.web3sec.news/blog/nextjs-october-november-2026-security-advisoriesNext.js October and November 2026 advisories: patch the deployed artifact2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Recent framework advisories connect upstream libraries, image processing, caching and cookie handling to the software actually running in production.

https://www.web3sec.news/blog/bybit-safe-signing-boundaryBybit and Safe: the signing interface is part of your security boundary2026-11-08T00:00:00Z2026-11-08T00:00:00Z

The February 2025 theft shows why multiple signatures cannot compensate for a shared, compromised view of a transaction.

https://www.web3sec.news/blog/radiant-capital-developer-opsecRadiant Capital: a document request can become a treasury incident2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A reported malware delivery chain connects developer communications, workstation trust and multisig operations.

https://www.web3sec.news/blog/wazirx-custody-responsibilityWazirX: make custody responsibilities testable before an incident2026-11-08T00:00:00Z2026-11-08T00:00:00Z

The July 2024 wallet theft illustrates the operational consequences of unclear verification and response responsibilities.

https://www.web3sec.news/blog/snowflake-stolen-credentialsSnowflake customer intrusions: old credentials can remain a live attack path2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Mandiant’s 2024 investigation connects infostealer exposure, missing MFA and cloud data theft.

https://www.web3sec.news/blog/cloudflare-token-rotationCloudflare’s Thanksgiving incident: a rotation checklist needs closure evidence2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A 2024 disclosure about a 2023 intrusion shows how residual credentials can outlive an initial response.

https://www.web3sec.news/blog/tj-actions-ci-secret-exposuretj-actions compromise: CI logs can become a secret-exfiltration channel2026-11-08T00:00:00Z2026-11-08T00:00:00Z

CVE-2025-30066 demonstrates why action versions, workflow permissions and build logs belong in one threat model.

https://www.web3sec.news/blog/xz-build-artifact-trustXZ backdoor: review the artifact you deploy, not only the repository2026-11-08T00:00:00Z2026-11-08T00:00:00Z

CVE-2024-3094 illustrates the gap between source review, release packaging and the executable shipped downstream.

https://www.web3sec.news/blog/ai-agents-prompt-injection-boundariesAI agents: keep untrusted content away from authorization decisions2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A practical control model for assistants that read the web, inspect repositories and act through connected tools.

https://www.web3sec.news/blog/identity-mfa-recovery-runbookIdentity security: phishing-resistant login, usable recovery and verified offboarding2026-11-08T00:00:00Z2026-11-08T00:00:00Z

An operating procedure for the accounts that control email, cloud infrastructure, source code and company recovery.

https://www.web3sec.news/blog/email-account-security-runbookEmail security: protect the recovery inbox and control who can send as your domain2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Separate mailbox compromise, domain spoofing and support impersonation into controls with observable tests.

https://www.web3sec.news/blog/domain-dns-security-runbookDomain and DNS security: preserve control of the address your users trust2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A runbook for registrar ownership, scoped DNS changes, renewal resilience and safe nameserver recovery.

https://www.web3sec.news/blog/developer-device-security-runbookDeveloper device security: isolate experiments from production authority2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A practical baseline for laptops that handle source code, external repositories, credentials and sensitive client material.

https://www.web3sec.news/blog/browser-extension-security-runbookBrowser and extension security: reduce the code surrounding every privileged session2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Inventory permissions, separate sensitive browsing and prepare for malicious extensions or stolen browser sessions.

https://www.web3sec.news/blog/github-ci-security-runbookGitHub and CI/CD security: keep untrusted changes away from deployment authority2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A review procedure for workflow triggers, action revisions, runner isolation and cloud deployment identity.

https://www.web3sec.news/blog/package-publishing-security-runbookPackage publishing security: control who can ship and what consumers execute2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A practical process for registry access, trusted publishing, provenance, dependency review and compromised releases.

https://www.web3sec.news/blog/cloud-iam-secrets-runbookCloud IAM and secrets: reduce standing access and prove revocation2026-11-08T00:00:00Z2026-11-08T00:00:00Z

An operating model for human roles, workload identities, secret consumers and emergency cloud access.

https://www.web3sec.news/blog/production-data-backup-runbookProduction data and backups: prove you can recover without giving attackers a second copy2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A runbook for database access, backup isolation, retention, restoration and safe evidence during data incidents.

https://www.web3sec.news/blog/api-authorization-review-runbookAPI authorization: test the actor, object and action together2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A practical review method for cross-tenant access, administrative functions, exports, background jobs and failure behavior.

https://www.web3sec.news/blog/multisig-treasury-security-runbookMultisig treasury operations: verify the transaction and every path around the threshold2026-11-08T00:00:00Z2026-11-08T00:00:00Z

An operating runbook for signer independence, privileged transactions, modules, monitoring and recovery rehearsal.

https://www.web3sec.news/blog/community-support-security-runbookCommunity and support security: protect announcements without becoming a recovery scam2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Practical controls for moderators, bots, public links, support evidence and incident communications.

https://www.web3sec.news/blog/ai-agent-mcp-security-runbookAI agent and MCP security: constrain the tool, not just the prompt2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A runbook for agent integrations, local servers, authorization, data access and realistic prompt-injection tests.

https://www.web3sec.news/blog/incident-evidence-runbookIncident evidence: preserve what happened without spreading the breach2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A procedure for first-response records, log exports, file provenance, access restrictions and investigative handoff.

https://www.web3sec.news/blog/incident-tabletop-runbookIncident tabletop: rehearse decisions while the systems are still healthy2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A repeatable exercise format for founders, engineering, security, support and the people authorized to stop operations.

https://www.web3sec.news/blog/security-monitoring-runbookSecurity monitoring: connect important events to an owner who can act2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Build a small, testable detection system around identity changes, deployments, data access and treasury authority.

https://www.web3sec.news/blog/frontend-third-party-script-securityFrontend security: review every script that can change what a user sees2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A practical review of browser code, tag managers and content security policies, including the interactions a successful build can still break.

https://www.web3sec.news/blog/security-writing-evidence-reviewWrite a security finding someone else can verify2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A review procedure for findings, incident narratives and technical articles: keep evidence, inference, recommendations and uncertainty separate.

https://www.web3sec.news/blog/personal-ai-assistant-email-calendar-securityConnect an AI assistant to email and calendars without delegating your entire identity2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Decide what the assistant can read, draft, send and delete, then rehearse a malicious-message and disconnected-account scenario.

https://www.web3sec.news/blog/financial-ai-agent-permission-boundariesFinancial AI agents: separate research, transaction preparation and execution authority2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Design payment and treasury workflows around verified destinations, transaction-bound approvals, limits and an independent stop control.

https://www.web3sec.news/blog/untrusted-repository-research-sandboxRun unfamiliar research repositories without lending them your laptop’s credentials2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Inspect before executing, isolate dependencies and tests, constrain network and filesystem access, and verify disposal with dummy secrets.

https://www.web3sec.news/blog/ai-assisted-bug-bounty-workflowAI-assisted bug bounty work: keep scope, execution and evidence under researcher control2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Use agents for understanding and reproducible reporting while preserving program authorization, data boundaries and meaningful human validation.

https://www.web3sec.news/blog/mcp-server-installation-reviewBefore installing an MCP server: review the package, process and connected account separately2026-11-08T00:00:00Z2026-11-08T00:00:00Z

A preflight and change-review procedure for local and remote MCP integrations, from installation hooks to token revocation.

https://www.web3sec.news/blog/agent-secrets-scope-and-recoveryAgent credentials: issue the smallest useful secret and prove you can revoke it2026-11-08T00:00:00Z2026-11-08T00:00:00Z

An operating procedure for task-scoped identities, secret delivery, output review and recovery after unintended access or upload.

https://www.web3sec.news/blog/browser-agent-session-securityBrowser agents and logged-in sessions: protect the account behind the tab2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Review the authority inherited from cookies, browser profiles, connected sites and downloads before an agent uses an authenticated browser.

https://www.web3sec.news/blog/agent-memory-retrieval-poisoningAgent memory and RAG: prevent retrieved text from becoming persistent policy2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Track source provenance, enforce current retrieval permissions and test whether poisoned content survives into later tasks.

https://www.web3sec.news/blog/agent-skills-plugin-reviewReview agent skills and plugins as instructions, dependencies and delegated authority2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Inspect the whole instruction bundle, referenced resources and effective permissions before enabling a workflow extension or accepting its update.

https://www.web3sec.news/blog/unattended-agent-schedules-and-budgetsUnattended agents: bound schedules, retries, cumulative usage and stale approvals2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Make repeated agent work stop predictably when permissions, timing, costs or external side effects no longer match the approved task.

https://www.web3sec.news/blog/agent-localhost-network-boundariesAgents, localhost and internal networks: enforce what the executor can actually reach2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Protect local bridges, development services, cloud metadata and internal APIs with explicit network and application boundaries.

https://www.web3sec.news/blog/scope-mobile-app-security-testScope a mobile security test: the app, the device and the API are separate boundaries2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Prepare Android and iOS builds, device coverage, representative accounts and acceptance criteria so a mobile assessment answers a real release question.

https://www.web3sec.news/blog/mobile-deep-links-session-boundariesMobile deep links: verify the destination without trusting the requested action2026-11-08T00:00:00Z2026-11-08T00:00:00Z

Review Android App Links, iOS universal links, custom schemes and exported entry points against account state, input validation and server authorization.