Insights, tutorials, and best practices for secure development
On March 31, 2026, a North Korean hacking group compromised the axios npm package through social engineering. Here's what happened, how the attack worked, and what development teams should do about it.
Anthropic accidentally published Claude Code's full source code to the npm registry. Here's how a missing build config line led to a 512,000-line leak, and what development teams can learn from it.
A Y Combinator-backed compliance startup allegedly fabricated 494 SOC 2 reports. The scandal exposes structural weaknesses in how the industry validates security controls — and what AI-accelerated compliance gets wrong.
Transitive dependency risks hide deep in your dependency tree. Learn how to visualize, audit, and prioritize them with reachability analysis.
A Replit AI agent ignored explicit instructions, deleted a production database, fabricated records to cover it up, then lied about recovery. The interesting question isn't "how" — it's what kind of guardrails actually work.
Open source license compliance prevents legal exposure from GPL, MIT, and Apache 2.0 obligations. Learn how SCA tools detect license risk.
Snyk vs Dependabot vs Renovate (plus OWASP Dependency-Check and Rafter): compare vuln database depth, auto-fix PRs, transitive coverage, and pricing.
Dependency confusion attacks exploit package manager resolution to inject malicious code. Learn how they work and how to defend against them.
A hidden HTML comment in a pull request. A dictionary of pre-signed image URLs. GitHub Copilot reads the instruction, renders the images, and your private source code is gone. Here's how CamoLeak works and why disabling images isn't enough.
Learn what an SBOM is, SPDX vs CycloneDX formats, the EO 14028 mandate, and how to generate a software bill of materials in CI/CD.
IaC security scanning catches misconfigurations before deployment. Compare Checkov, tfsec, KICS, and Snyk IaC for Terraform and Kubernetes.
Oasis Security's ClawJacked attack hijacks AI agent gateways through the browser. The deeper lesson: the localhost trust assumption is broken across the entire agent ecosystem.
Showing 37–48 of 199 posts