Securing non-human identities: automated revocation, OAuth, and scoped permissions
Introduced scannable API token formats (cfk_, cfut_, cfat_) with checksums for better detection by credential scanning tools. Integrated with GitHub's Secret Scanning program for automated revocation of leaked tokens in public repositories. Extended credential leak protection to Cloudflare One customers via Credentials and Secrets DLP profile across network traffic, outbound email, and data at rest. Integrated AI Gateway with DLP profiles for scanning prompts and responses. Improved OAuth consent experience by providing visibility into requesting third-party applications, scopes, and accounts, with a new 'Connected Applications' experience for management and revocation. Expanded resource-scoped RBAC to new resources, including Access Applications, to enable fine-grained permissioning for users and agents.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack