Blog
Security
/ 21 Sep, 2025Access tokens strike again, the Salesloft Drift breach
In mid‑August 2025, GTIG confirmed a large‑scale credential‑harvesting and data‑theft campaign abusing trusted OAuth integrations (Drift) to access Salesforce orgs.
Attackers (UNC6395) used stolen Drift OAuth tokens to mass‑query Salesforce, mine embedded secrets (AWS, Snowflake), and pivot into connected platforms.
This post reconstructs the attack flow, maps it to MITRE ATT&CK, and outlines immediate detection and defense actions.

Security
/ 21 Sep, 2025Access tokens strike again, the Salesloft Drift breach
In mid‑August 2025, GTIG confirmed a large‑scale credential‑harvesting and data‑theft campaign abusing trusted OAuth integrations (Drift) to access Salesforce orgs.
Attackers (UNC6395) used stolen Drift OAuth tokens to mass‑query Salesforce, mine embedded secrets (AWS, Snowflake), and pivot into connected platforms.
This post reconstructs the attack flow, maps it to MITRE ATT&CK, and outlines immediate detection and defense actions.

New Feature
/ 20 Jul, 2023Synchronous Webhooks
We are excited to release synchronous webhooks, the latest addition to our webhooks features.
With synchronous webhooks, you can extend SlashID Access to suit your business needs in a few simple steps, in whatever language and environment makes sense for you.

Tutorial
/ 16 Jul, 2023Building a React Login Page Template
Discover how to create a secure login page for your React app with authentication and styling using SlashID.

New Feature
/ 10 Jun, 2023SlashID Analytics Webhooks
We are excited to release SlashID analytics and webhooks, providing greater visibility and actionable insights into your authentication flows.


Deep Dives
/ 24 May, 2023Passkeys - Threat modeling and implementation considerations
In this blog post, we review the current state of the technology from a security standpoint and we’ll discuss some critical aspects of passkey implementation.


New Feature
/ 12 May, 2023Authentication flows with SlashID
Implement MFA and Step-Up Authentication in React applications with SlashID.


Tutorial
/ 20 Feb, 2023Using Google Tink to sign JWTs with ECDSA
In this blog post, we will show how the Tink cryptography library can be used to create, sign, and verify JSON Web Tokens (JWTs), as well as to manage the cryptographic keys for doing so.

New Feature
/ 9 Feb, 2023React SDK support for <Groups>
With the latest React SDK release we are introducing a new control component, <Groups>. You can use <Groups> to conditionally render parts of the UI depending on whether the authenticated user belongs to specific Groups.


New Feature
/ 18 Jan, 2023Sign-in and Sign-up React component release
Today we’re happy to announce the next step in that journey to deliver a streamlined, low friction onboarding experience to our customers with the release of our sign-up/sign-in form component.

New Feature
/ 16 Jan, 2023Fetching Google Groups with SlashID SSO
Use SlashID to fetch Google Groups as part of a user authentication flow.
