Workload Identity Federation Explained (2026): OIDC Instead of Cloud Keys
Workload identity federation explained: why long-lived cloud keys keep leaking (29M secrets on GitHub in 2025), how OIDC token exchange works on AWS, Google Cloud and Azure, Kubernetes projected tokens, SPIFFE, and GitHub's July 2026 immutable subject change.
13 minOct 20, 2026How to Deploy a Secure Remote MCP Server with OAuth (2026)
Step-by-step: run a remote MCP server over Streamable HTTP as an OAuth 2.1 resource server with Keycloak 26.8.1 and MCP Python SDK 2.3.0, validate audience and scopes per tool, add rate limits and audit logs, deploy to Cloud Run, and fix 401 and discovery errors.
16 minOct 20, 2026Secrets Sprawl 2026: 28.65M Leaked Keys and 64% Still Valid Years Later
What the 2026 secrets sprawl data says: 28.65M new secrets on public GitHub in 2025, AI service keys up 81%, AI-assisted commits leaking at twice the baseline, 24,008 secrets in MCP configs, 10,456 leaky Docker Hub images, and why 64% of old leaks still work.
13 minOct 20, 2026MCP Authorization Explained: OAuth 2.1, RFC 9728 and CIMD in 2026
How MCP authorization works in the 2026-07-28 spec: OAuth 2.1 with PKCE, RFC 9728 protected resource metadata, RFC 8707 resource indicators, Client ID Metadata Documents replacing deprecated DCR, the token passthrough ban, and enterprise IdP access through ID-JAG.
12 minOct 20, 2026How to Use External Secrets Operator with Vault on Kubernetes (2026)
Step-by-step External Secrets Operator v2.13 setup with HashiCorp Vault, OpenBao or AWS Secrets Manager: Helm install, Kubernetes auth, ClusterSecretStore, ExternalSecret, rotation and reloads, ESO's 2025 release pause, alternatives, and fixes for SecretSyncedError.
14 minSep 9, 2026Agent-to-Agent Protocols in 2026: A2A Reached 1.0, Three ACPs Died or Merged, and MCP Learned to Do Most of the Same Job
What Google's Agent2Agent protocol actually specifies at v1.0, what changed when it moved into the Agentic AI Foundation in August, which vendors have shipped it versus announced it, how MCP's July 2026 revision reproduced A2A's task lifecycle almost state for state, the first real CVE on an A2A surface, what the production data says about how rare multi-hop agent systems are, and a working server and client on the 1.1 SDK with the breaking changes listed.
14 minSep 7, 2026Who Is This Agent? Non-Human Identity in 2026, From the RFCs to the Breaches
Machines outnumber humans 109 to 1 in the enterprise directory, the OAuth working group has 70 drafts in flight, MCP just deprecated dynamic registration, and an agent with an over-scoped token deleted a production database in nine seconds. What actually standardised this year, what shipped, and the delegation chain I would build.
16 min