Signal SentrySearchUpdated Nov 2, 05:30 UTCAM Drop
Security lens · Identity and access

Least privilege for people, tokens and tools

A hijacked account, token or tool reaches only what its task needs, not every system the team runs.

Where to start

Our reading of the guidance below, for a small team. A starting point, not a complete program.

  1. List who and what holds admin or write access, and remove access not used for current work.
  2. Give each token and service account only the scopes its one job needs.
  3. Grant admin rights for a set task and remove them when the task is done.

The guidance

  1. NIST · CSRC Glossary: least privilege

    A security principle that a system should restrict the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks.

  2. OWASP · Zero Trust Architecture Cheat Sheet

    Provide elevated access only when needed for a specific task

Short quotes from the official guidance, linked. Read the source before you act on it.

Incidents from the Drops

Security

Polymarket traders lose over $2 million through a compromised third-party script

Polymarket says a third-party provider was compromised; researchers tie it to DebugBear's monitoring script, which used logged-in sessions to sell positions or move tokens. Loss estimates: $2.19 million to $2.71 million.

Why it matters: A third-party script on a logged-in page acts with your users' authority. List the outside scripts your app loads and pin, self-host or drop them.

Confirmed Way in: a compromised third-party monitoring script loaded on the logged-in trading site

Controls that would have helped:

SecurityWeek · Oct 30
From Drop #058 · Sat, Oct 31, 2026 · Evening
Security

CISA lists exploited GitLab flaw; Alpine Linux says an attack on its instance failed

CISA added CVE-2026-97229 to its list of actively exploited vulnerabilities: an unauthenticated user can run code on a GitLab server through a crafted regex in CI/CD config. SecurityWeek reports a failed attempt on Alpine Linux.

Why it matters: If you self-host GitLab on your own Ruby build, Alpine Linux says upgrading GitLab alone left it exposed: check that Ruby is 3.3.13, 3.4.12, 4.0.9 or newer.

Confirmed Way in: crafted CI configurations sent from a newly registered account on the GitLab instance

Controls that would have helped:

CISA KEV catalog · Oct 29NVD CVE-2026-97229 · Oct 29SecurityWeek · Oct 30
From Drop #057 · Sat, Oct 31, 2026 · Morning
Security

Anthropic disputes a startup's claim its AI agents broke in within 12 hours

SecurityWeek, citing the Washington Post, says Cathedral claims its agents abused third-party business software to reach Anthropic meeting transcripts and salary data. Anthropic says only limited sales, HR and IT systems were reached.

Why it matters: If the startup's account holds, the way in was third-party business software, not the models; check what your SaaS tools would expose to a fast automated attacker.

Preliminary Way in: weaknesses in third-party business software, per the startup's draft report

Controls that would have helped:

SecurityWeek · Oct 30
From Drop #057 · Sat, Oct 31, 2026 · Morning