DevSecOps

The Salesloft/Drift OAuth Breach: When Your SaaS Integrations Become Attack Vectors

by

Executive Summary The Salesloft Drift OAuth breach (August 2025) compromised 700+ organizations through weaponized OAuth tokens, demonstrating why product security teams must threat model SaaS integrations as untrusted attack surfaces. This analysis examines the technical mechanics, architectural anti-patterns, and secure-by-design lessons for teams building or evaluating third-party integrations. The Attack: Six Months of Silent Credential … Read more

Stop Treating LLM Agents as Trusted Users: Lessons from GitLab CVE-2021-39935

by

CISA added CVE-2021-39935 to the KEV catalog on February 3, 2026 – a 2021 GitLab SSRF vulnerability now seeing active exploitation. The federal remediation deadline is February 24, 2026. This is worth examining not because it’s novel (GitLab patched it in October 2021), but because the threat model around CI/CD attack surfaces has fundamentally changed … Read more