datasette-acl 0.6a0: Expanding to a General Resource-Sharing Permission System
Simon Willison's Weblog39 days agoReleasedatasette-acl 0.6a0 is an alpha release that broadens the plugin's scope from table-level access control to a general resource-sharing system for Datasette. Alex Garcia led most of the development, enabling multi-user Datasette instances to apply fine-grained permissions across a wider range of platform resources. As an alpha, it signals architectural direction rather than a stable feature set, but matters for teams building access-controlled, collaborative Datasette deployments.
FIFA World Cup Broadcast System Had Critical Access Control Flaw Letting Anyone Take Over
INSIDE 硬塞 AI41 days agoIncidentA security researcher disclosed a critical broken access control vulnerability in FIFA's internal World Cup broadcast system. Because the backend API performed no authorization verification, any registered user could gain full administrative access to the live broadcast backend. This would have allowed modification of real-time video streams and match data; FIFA says the flaw has since been patched.
Vercel Passport is now in Public Beta
Vercel Changelog41 days agoReleaseVercel has announced that Vercel Passport is now available in public beta, opening the product to a broader audience after an earlier restricted phase. The name 'Passport' suggests an authentication, identity, or access-control offering within the Vercel ecosystem. No body copy was provided in the source, so specific feature details are unavailable.
Signed URLs are now available for Vercel Blob
Vercel Changelog56 days agoReleaseVercel announced that signed URLs are now available for Vercel Blob. Based on the title, the feature relates to controlled access to Blob resources and may help with restricted file delivery workflows. The source text was not provided, so implementation details, expiration behavior, plan limits, and pricing implications cannot be confirmed.
Hackers Asked Meta AI for Access to High-Profile Instagram Accounts. It Worked★ 78
Simon Willison's Weblog56 days agoIncidentSimon Willison highlights a 404 Media report about hackers taking over Instagram accounts through Meta's AI support bot. A video reportedly shows an attacker asking the bot to link a target account to a new email address and providing a code. Willison argues this barely qualifies as prompt injection: the core failure was granting a support bot enough authority to fast-forward the account recovery process.
Team-wide provider allowlist on AI Gateway
Vercel Changelog61 days agoReleaseVercel announced a team-wide provider allowlist for AI Gateway. Based only on the title, the update appears focused on centralized governance over which AI providers a team may use. This is likely most relevant to teams managing compliance, cost control, and approved provider access across multiple projects, rather than a new model capability.
Indent 如何利用 Next.js 與 Vercel 交付安全的即時存取控制服務
Vercel Changelog1,257 days agoBusinessThis is a case study on how Indent, a security access control platform, uses Next.js and Vercel to build its enterprise-grade security service. Indent…