Insights, tutorials, and best practices for secure development
A 22-year-old RIT student used cat memes, Discord conversations, and methodical research to help crack the Kimwolf botnet — two million compromised Android devices hiding in plain sight on home networks worldwide.
A security champion program embeds security expertise in every dev team. Learn how to select champions, define roles, and measure success.
Shift left security moves vulnerability detection to the earliest development stages. Learn the cost-of-fix curve and how to embed testing in your SDLC.
Every disclosed AI agent and AI coding tool security incident since 2025, with CVEs, severity ratings, affected products, and one-line descriptions. Updated as new incidents are disclosed.
On March 31, 2026, a North Korean hacking group compromised the axios npm package through social engineering. Here's what happened, how the attack worked, and what development teams should do about it.
Anthropic accidentally published Claude Code's full source code to the npm registry. Here's how a missing build config line led to a 512,000-line leak, and what development teams can learn from it.
A Y Combinator-backed compliance startup allegedly fabricated 494 SOC 2 reports. The scandal exposes structural weaknesses in how the industry validates security controls — and what AI-accelerated compliance gets wrong.
Transitive dependency risks hide deep in your dependency tree. Learn how to visualize, audit, and prioritize them with reachability analysis.
A Replit AI agent ignored explicit instructions, deleted a production database, fabricated records to cover it up, then lied about recovery. The interesting question isn't "how" — it's what kind of guardrails actually work.
Open source license compliance prevents legal exposure from GPL, MIT, and Apache 2.0 obligations. Learn how SCA tools detect license risk.
Compare SCA tools — Snyk, Dependabot, Renovate, OWASP Dependency-Check, and Rafter — on vulnerability detection, auto-fix PRs, and pricing.
Dependency confusion attacks exploit package manager resolution to inject malicious code. Learn how they work and how to defend against them.
Showing 25–36 of 191 posts