Security - 2

2025 (12)

December (9)

github: npm classic tokens revoked, session-based auth and CLI token management now available

GitHub

2025-12-09

On 2025-12-09 GitHub completed the deprecation of npm classic tokens by revoking them and moving to session-based authentication. At the same time GitHub released CLI token management features so developers can manage authentication tokens from the command line. This change is part of a security hardening effort and requires affected users and automation to re-authenticate and adopt the new session-based flows or updated tokens.

azure: [Launched] Generally Available: FIPS compliant mode for Application Gateway V2 SKUs

Azure Updates

2025-12-09

Azure Application Gateway V2 SKUs are now generally available with a FIPS 140-2 compliant mode, allowing customers to use FIPS-validated cryptographic modules to help meet US government and regulatory cryptography requirements.

dotnet: .NET 10 Networking Improvements

.NET

2025-12-08

The article announces networking improvements in .NET 10, highlighting updates across HTTP, WebSockets, security, and related areas to enhance performance, reliability, and the developer experience.

security: Stronger together: New Beazley collaboration enhances cyber resilience

Microsoft Security Blog

2025-12-08

Microsoft announced a new collaboration with Beazley naming them an incident response partner to strengthen cyber resilience by aligning with ecosystem partners and improving security for customers.

github: CodeQL 2.23.6 adds Swift 6.2.1 and new C# security queries

GitHub

2025-12-04

CodeQL 2.23.6 has been released, adding support for Swift 6.2.1 and introducing new C# security queries. CodeQL is the static analysis engine behind GitHub code scanning, used to find and remediate security issues. The announcement appeared on The GitHub Blog.

ai: Announcing Foundry MCP Server (preview), speeding up AI development with Microsoft Foundry

Microsoft AI Foundry Blog

2025-12-03

Microsoft announced the Foundry MCP Server (preview), building on the Model Context Protocol (MCP) to help AI agents securely connect with apps, data, and systems. At Ignite, Microsoft Foundry also introduced Foundry Tools as a central hub to discover, connect, and manage both public and private MCP tools securely, simplifying integration and expanding interoperability.

azure: [Launched] Generally Available: The credcheck extension in Azure Database for PostgreSQL Flexible Server

Azure Updates

2025-12-03

Azure Database for PostgreSQL Flexible Server now supports the credcheck extension (general availability), which enforces password and credential validation policies directly within PostgreSQL.

github: Secret scanning updates — November 2025

GitHub

2025-12-02

GitHub Secret Scanning received updates in November 2025 that added support for 24 new secret types via new provider patterns; details were published in the GitHub Blog changelog.

github: Block repository administrators from installing GitHub Apps on their own now generally available

GitHub

2025-12-01

GitHub rolled out a new organization-level setting (now generally available) that lets organization owners prevent repository administrators from installing GitHub Apps on repositories, giving owners tighter control over app installation and repository surface area.

November (3)

github: Secret scanning alert assignees, security campaigns are generally available

GitHub

2025-11-25

GitHub announced that secret scanning alert assignees and security campaigns are now generally available. Alert assignees will receive email notifications to help teams track and remediate secret scanning alerts more effectively.

github: Secrets in unlisted GitHub gists are reported to secret scanning partners

GitHub

2025-11-25

As of 2025-11-25, GitHub will report publicly leaked secrets found in unlisted gists to the appropriate secret scanning partners, extending secret-scanning reporting beyond only listed/public gists.

devops+ai: 🔥Building Audit Logging for Multi-Platform AI Bots with Python, AWS Cloudwatch🔥

Let's do DevOps

2025-11-25

This article explains how to build audit logging for multi-platform AI bots using Python and AWS CloudWatch to answer questions like “who is actually using our bots today?”. It covers architecture, event schema, ingestion, storage, querying, privacy considerations, and practical implementation tips to capture, ship, and analyze bot usage across channels.