ai-securitysupply-chainllm+2 more
When Malware Argues With Your AI Scanner
A credential stealer hid a prompt injection telling AI scanners the package is clean. The flip side worries me more: malware that makes the AI look away.
7 min read
Blog
Insights, tutorials, and best practices for secure development
announcementssupply-chaingithub+2 more
Rafter Is Now on the GitHub Marketplace
Rafter is now installable from the GitHub Marketplace. Add the Action to your workflow and Rafter scans the repo in CI on every push — dependency and supply-chain findings, secrets, and a security score, at the exact moment a vibe-coded prototype becomes real code that needs scanning.
7 min read
api-keysstripesecrets+2 more
Stripe API Key Security: Best Practices for 2026
Stripe API key security and best practices 2026: key types, sk_live_ vs sk_test_, restricted keys, rotation, and catching leaks before attackers do.
9 min read
supply-chainai-securityai-agents+2 more
TrapDoor: The Supply-Chain Attack That Poisons Your AI Assistant's Instructions
TrapDoor hid invisible instructions in CLAUDE.md and .cursorrules so coding agents could be tricked into running a fake security scan and exfiltrating developer secrets. The agent-instruction file is now part of your attack surface. Here's the attack and the defense.
10 min read
secretsapi-keyssecurity+2 more
Gitleaks vs TruffleHog (2026): Which Secret Scanner Wins?
Gitleaks vs TruffleHog for 2026 — detection method, speed, pre-commit and CI fit, false positives, and which secret scanner to choose for your team.
8 min read
sastcomparisonsecurity+2 more
Semgrep vs SonarQube (2026): Which SAST Tool Wins?
Semgrep vs SonarQube compared on custom rules, taint analysis for injection, language coverage, CI/CD fit, and pricing — with a clear pick by team profile.
9 min read
owaspai-code-securityvibe-coding+2 more
OWASP Top 10:2025 — A10 Mishandling of Exceptional Conditions for AI-Generated Code
How vibe-coded apps fail at error handling — and the exact prompts to fix unhandled exceptions, null derefs, and resource leaks in AI-generated code.
5 min read
data-breachphishingedtech+2 more
A Vendor Breach, an Education-Sector Phishing Wave, and Three Days to the Leak Deadline: The Canvas / Instructure Incident
On April 29, 2026, Instructure detected unauthorized activity in Canvas. By May 7, the same actor had defaced login pages at multiple institutions. ShinyHunters claims data on 275 million users across 8,809 institutions and has set May 12 as a leak deadline. The data scope is narrow — names, emails, student IDs, Canvas messages — and that is precisely what makes the second-order phishing wave dangerous.
8 min read
secretsapi-keyssecurity+3 more
Shannon Entropy Wasn't Enough: Why Betterleaks Replaces Gitleaks
Zach Rice — the creator of Gitleaks — shipped a new scanner called Betterleaks. It uses byte-pair encoding token efficiency instead of Shannon entropy and lifts recall from 70.4% to 98.6% on the CredData benchmark. Here's what that actually means.
8 min read
supply-chainai-securityincidents+2 more
PyTorch Lightning, Mini Shai-Hulud, and Malware That Signs Commits as Claude Code
On April 30, 2026, two malicious versions of the PyPI package lightning — 2.6.2 and 2.6.3 — were published with credential-stealing code that activates on import. The package backs PyTorch Lightning, a 31,000-star AI-training library. The detail worth stopping on: every poisoned commit the worm pushes to victim repositories is authored under a hardcoded identity designed to impersonate Anthropic's Claude Code.
8 min read
securitytoolscomparison+3 more
Vulnerability Scanning Tools Comparison: Snyk vs SonarQube vs Semgrep vs CodeQL vs GHAS vs Rafter
Compare the top vulnerability scanning tools for 2026. See how Snyk, SonarQube, Semgrep, CodeQL, GitHub Advanced Security, and Rafter stack up on accuracy, speed, language support, and pricing.
17 min read
phishingemail-securityai-security+2 more
A Real Email From Robinhood Carrying Real Phishing — and the Inbox-Reading Agent Built to Trust It
On April 26, 2026, Robinhood's own mail infrastructure sent phishing emails to its own users. SPF, DKIM, and DMARC all passed. The malicious HTML and phishing URL were interpolated into the email body by an unsanitized device-name field during the attacker's signup flow. Humans noticed on a careful read. Inbox-reading AI agents — built to trust the signed channel and act on what's inside — won't.
9 min read
Showing 1–12 of 199 posts