Security Insights
Software security insights, engineering guidance, and analysis covering secure development, vulnerabilities, and modern application security.
The Miasma Worm: A Developer's Guide to the Supply Chain Attack Rewriting the Rules
The Miasma supply chain worm: how it spreads through npm install, hides in AI coding tools, uses GitHub as its command channel, and what your defenses need to look like.
AI-Generated Code Security: How to Close the Review Gap
When AI writes your code, security vulnerabilities slip through faster. Learn how algorithm confusion, hallucinated packages, and outdated dependencies enter your codebase and what automated tools can catch them.
The Anatomy of a Credential Leak: From Forgotten API Key to Breach
A hardcoded secret committed in a late-night hotfix can be stolen in under a minute. Here is how credential leaks happen, what attackers do with them, and how secret scanning and git history rewriting limit the damage.
The Axios Supply Chain Attack: A Developer Debrief
On March 31, 2026, axios (npm's most-downloaded HTTP package) was backdoored for 3 hours. Here is how the attack worked and what defenders should have done.
Dependency Confusion: How Attackers Use Your Own Package Names Against You
Dependency confusion attacks turn your internal package names into an attack vector. Here is how the technique works, how it has evolved since Alex Birsan's 2021 research, and how to defend against it.
What the EU Cyber Resilience Act Actually Changes for Your Engineering Team
The CRA isn't just a compliance checkbox. It rewrites what 'secure by design' means for dev teams shipping software in Europe. Here is what changes in practice: SBOMs, 72-hour disclosure, dependency hygiene, and the 2027 enforcement clock.
The Miasma Worm: A Developer's Guide to the Supply Chain Attack Rewriting the Rules
The Miasma supply chain worm: how it spreads through npm install, hides in AI coding tools, uses GitHub as its command channel, and what your defenses need to look like.
SBOM Compliance: What to Check and Why It Matters for CRA, NIS2 and SOC2
CRA, NIS2 and SOC2 all require SBOMs. Learn what each framework mandates, what a compliant Software Bill of Materials must contain, and how to build one into your CI/CD pipeline.
Transitive Dependencies: The Security Blind Spot Hiding in Plain Sight
You added 5 packages. You got 200. One of them has a CVE. Here is the math behind transitive dependency risk, why most teams miss it entirely, and what good visibility actually looks like.
Ready to stop reading and start fixing?
Connect a repo and get your first auto-fix pull request in minutes. Free for 25 repos.