Why SlashID
Identity ProtectionBlogDocumentation
Why SlashID
Use Cases
Discover Identity RiskEliminate IAM DebtIdentity Threat Detection & ResponseIdentity Security Posture ManagementAutomate Compliance Gap AnalysisSecure Non-Human IdentitiesStop Phishing & Vishing AttemptsDiscover & Block Shadow AppsIdentity ProtectionBlogDocumentation

Blog

Security

/ 21 Sep, 2025

Access tokens strike again, the Salesloft Drift breach

In mid‑August 2025, GTIG confirmed a large‑scale credential‑harvesting and data‑theft campaign abusing trusted OAuth integrations (Drift) to access Salesforce orgs.

Attackers (UNC6395) used stolen Drift OAuth tokens to mass‑query Salesforce, mine embedded secrets (AWS, Snowflake), and pivot into connected platforms.

This post reconstructs the attack flow, maps it to MITRE ATT&CK, and outlines immediate detection and defense actions.

Access tokens strike again, the Salesloft Drift breach

Security

/ 21 Sep, 2025

Access tokens strike again, the Salesloft Drift breach

In mid‑August 2025, GTIG confirmed a large‑scale credential‑harvesting and data‑theft campaign abusing trusted OAuth integrations (Drift) to access Salesforce orgs.

Attackers (UNC6395) used stolen Drift OAuth tokens to mass‑query Salesforce, mine embedded secrets (AWS, Snowflake), and pivot into connected platforms.

This post reconstructs the attack flow, maps it to MITRE ATT&CK, and outlines immediate detection and defense actions.

SlashID Team
SlashID Team

Tutorial

/ 10 Oct, 2023

Context-aware authentication: fight identity fraud and qualify your users

Knowing your users is becoming increasingly important. Whether you're a B2B PLG business trying to convert leads or a fintech business fending off attacks, it's essential to have more context about who is accessing your platform and to customize your behavior accordingly.

In this article, we show how you can leverage SlashID's webhooks to enrich the authentication context, customize the user journey, block malicious users.

Vincenzo Iozzo
Vincenzo Iozzo

Deep Dives

/ 28 Sep, 2023

Backend Authentication and Authorization Patterns: Benefits and Pitfalls of Each

Identity in distributed applications is hard. In large and complex environments with multiple services, a number of patterns have emerged to authenticate and authorize traffic.

In this article, we’ll discuss the most common ones, how to implement them, and their pros and cons.

Vincenzo Iozzo
Vincenzo Iozzo

Deep Dives

/ 21 Sep, 2023

JWT Implementation Pitfalls, Security Threats, and Our Approach to Mitigate Them

JSON Web Tokens (JWTs) are one of the most common ways to transfer identity claims and prove the identity of a user or an entity. JWTs have become very popular in recent years because they are easy to use, read, and debug.

JWTs provide a lot of flexibility at the expense of several security risks that are often overlooked. In this article, we'll discuss common risks when implementing or manipulating JWTs and our approach to avoiding them.

Vincenzo Iozzo
Vincenzo Iozzo

Tutorial

/ 18 Sep, 2023

No-code anti-phishing protection of internal apps with Passkeys

Phishing is one of the most common causes of data breaches. According to Verizon's DBIR report, over 50% of incidents start with phishing or stolen credentials. WebAuthn/Passkeys are an effective way to stop phishing and credential stealing attempts on their tracks.

In this article, we’ll show how you can use Gate to enforce Passkeys authentication for users without modifying the application code.

Vincenzo Iozzo
Vincenzo Iozzo

Tutorial

/ 14 Sep, 2023

Firewalling OpenAI APIs: Data loss prevention and identity access control

Large Language Models (LLMs) have taken the world by storm, and they are now used for many tasks by consumers and enterprises alike. However, the risk of accidentally disclosing sensitive data to the models is very high as the recent Samsung case shown.

In this article, we’ll show how you can use Gate to detect sensitive data in requests sent to the OpenAI APIs, as well as enforcing access control so that only users with certain roles can access the APIs.

Vincenzo Iozzo
Vincenzo Iozzo

New Feature

/ 12 Sep, 2023

Ditch your organizations table

Suborgs make it effortless and secure to implement complex identity structures such as multi-tenancy B2B apps and multi sided marketplaces.

Vincenzo Iozzo, Joseph Gardner
Vincenzo Iozzo, Joseph Gardner
Vincenzo Iozzo, Joseph Gardner

Tutorial

/ 5 Sep, 2023

Protecting Exposed APIs: Avoid Data Leaks with SlashID Gate and OPA

Adequately protecting APIs is key to avoid data leaks and breaches.

Just recently, an exposed API allowed an attacker to scrape over 2.6 million records from Duolingo.

In this article, we’ll show how you can use Gate to detect, respond to, and prevent these kinds of incidents.

Vincenzo Iozzo
Vincenzo Iozzo

Open Source

/ 28 Aug, 2023

Docusaurus - Authentication and authorization with SlashID

The latest docusaurus-slashid-login theme adds finer grained access control to your Docusaurus website.

Ivan Kovic
Ivan Kovic

New Feature

/ 25 Jul, 2023

Authenticate your Shopify customers with SlashID

The new SlashID Login app for Shopify lets your customers authenticate seamlessly using quick and safe methods like passkeys, social login and magic links.

Ivan Kovic, Kasper Mroz, Matilde Stefanini, Vincenzo Iozzo
Ivan Kovic, Kasper Mroz, Matilde Stefanini, Vincenzo Iozzo
Ivan Kovic, Kasper Mroz, Matilde Stefanini, Vincenzo Iozzo
Ivan Kovic, Kasper Mroz, Matilde Stefanini, Vincenzo Iozzo
Ivan Kovic, Kasper Mroz, Matilde Stefanini, Vincenzo Iozzo
1 2 3 4 5 6

Ready to start a top-tier security upgrade?

Get in touch
Terms · Privacy · System Status
© 2025 SlashID® Inc. All Rights Reserved.

Products

Why SlashID
Identity Protection Use Cases
Identity Management

Resources

Blog Documentation

We use cookies to improve your experience. Read our cookie policy.