Jan-Helge Bergesen·1d agoVetting dependencies before your coding agent installs them13. nov. 2026 · @Jan-Helge Bergesen
Shruti Vijay Shinde·1d agoA03: Software Supply Chain Failures — OWASP Top 10 (2025)Part 3 of my OWASP Top 10 (2025) series. Catch up on A02: Security Misconfiguration and Broken Access Control — the #1 web security risk…
Babak Rahimi·4d agoTrust Before You Pull: Inside Sophilia’s Safe RegistryEvery engineer pulls a database, a model runtime, or a vector store onto their laptop. We made sure the one they pull has already been…
Kaif Mohammed Khan·5d agoArchitecting Resilience: From Git Commit to GitOps Continuous Deployment, Zrok Tunnelling, and…The modern software delivery lifecycle often fractures at the boundary between Continuous Integration (CI) and Continuous Deployment (CD)…
Kenneth chinedu·6d agoThreat Modeling a GitHub Actions Pipeline: Where the Secrets Actually LeakA platform security engineer’s walkthrough: one data flow diagram, two trust boundaries, two threats worth fixing everywhere.
Zachary Cater·Nov 6My Takeaways on npm and GitHub ActionsAfter reading “Disrupting supply chain attacks on npm and GitHub Actions, by Greg Ose and Zachary Steindler,” I have a better understanding…
Kiran Yenaganti·Nov 6Deprecated MCP Servers: Why AI Coding Agents Install Packages That Will Never Be PatchedMCPhantom shows that a model’s memory is choosing your dependencies. Here is where a runtime check should step in.
InSkill StuffbyCodeTune·Nov 5A Compression Bug in Node.js Became a Security Problem Far Beyond JavaScriptOne vulnerable Brotli decoder crossed Node.js, Python, .NET, Java, Bun, Envoy, and Istio, exposing how much supposedly separate software…
Sudipto K Haldar·Nov 5Shipping an MCP Server, Part IV: Automate Releases with No SecretsA pushed tag that becomes a PyPI release and a Registry listing, with no credential stored anywhereA response icon1A response icon1
InSkill StuffbyCodeTune·Nov 4Attackers Didn’t Bypass the Security Tool. They Used Its Update PathIf software can update itself as root, the updater is part of your production security architecture.A response icon1A response icon1
