Whose Authority Does Your Docker Hub Token Carry?
A credential handover needs an explanation of who holds each secret, which service uses it and what that service should be allowed to do.
Access Tokens
A Leaked GitLab Email Address Can Become a Code-Push Credential
An incoming GitLab email address carries account authority. Research shows why a leaked address needs the same response as a leaked access token.
Your MFA Can Work Perfectly While a Stolen Token Lets an Attacker In
A successful MFA login is one security decision. The token used afterwards is another. NIST's final guidance gives cloud buyers better questions to ask about that second boundary.