Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
CVE-2026-35603: Cursor Still Trusts a World-Writable Folder
TL;DR Claude Code, Cursor, Codex CLI and Gemini CLI on Windows all load machine-wide configuration from C:\ProgramData\ , a folder any standard user…
drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner (2026 Benchmark)
drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner Benchmarked on 500+ web3 repositories. Generic scanners miss 73% of web3-…
Building a Read-Only Cloudflare Worker AI Security Console
Why build this Security teams already have WAF events, bot signals, access logs, and SIEM pipelines. The problem is not always data collection. The…
The Perimeter Moved to the Laptop: From Network, to Identity, to the Developer Endpoint
👉 TL;DR: The perimeter has moved before. It went from the network to identity, the shift everyone summarized as "identity is the new perimeter." It…
Where the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT Pipeline
Every VAPT report ends the same way: a handful of numbers. A CVSS score. A severity label. A priority rank. Sometimes an aggregate risk score. Those…
Can Copilot Fix Its Own Security Findings? Testing GitHub Agentic Autofix
Can Copilot Fix Its Own Security Findings? Testing GitHub Agentic Autofix GitHub can now assign a code scanning alert directly to Copilot cloud agen…
🛡️ Vulnerability Math: CVE vs. CVSS vs. EPSS
Ever wonder why some "Critical" bugs aren't fixed immediately? It’s all about Impact vs. Urgency . Think of a Broken Lock on your front door: CVE (T…
The Command Injection Fix Cursor Writes Still Runs Code (CWE-78)
TL;DR Cursor writes exec() with your input pasted into the command string, which is textbook command injection (CWE-78). Ask it to fix that and it a…
Proof-of-Fix in GSC: An Architecture for Provable Vulnerability Remediation Verification
Abstract GSC is a self-learning AppSec platform implementing the full pipeline detect → prove → fix → verify → heal → predict . Its defining feature…
How to Build an Audit-Ready CloudTrail and Config Baseline
An auditor asks: "Show who disabled logging in production last quarter." You open three accounts, find CloudTrail off in one, logs scattered in loca…
Turn Trivy SBOM and SARIF output into versioned release evidence
Security tools already generate useful evidence. The problem at release time is often not another scan. It is proving which SBOM, test run, security…
The Path Traversal Fix Cursor Writes Ignores Symlinks (CWE-22)
TL;DR Ask Cursor to fix a path traversal bug and you get path.basename , path.resolve , and a startsWith containment check. It looks like the textbo…
Cursor Learned to Code From Tutorials That Skip Security
TL;DR AI editors did not learn security from security documentation. They learned from tutorials, and tutorials strip security controls on purpose t…
The Linux Skills That Separate Junior and Senior DevOps Engineers: A Practical Comparison
Introduction Many people believe that becoming a senior DevOps engineer means learning Kubernetes, Terraform, or cloud platforms. While those skills…
Why Deleting a Hardcoded Secret Does Not Fix It (CWE-798)
TL;DR AI editors paste real-looking API keys, JWT secrets, and DB passwords straight into your source code because their training data is full of tu…
Confronting Vault Sprawl And The Risks It Brings
Modern enterprises do not set out to create a maze of credentials, keys, and secrets stores. However, this is the reality most organizations find th…
Why Cursor Keeps Generating Wildcard CORS Headers in Your API
TL;DR AI editors keep generating CORS middleware that reflects the request's Origin header back verbatim while also allowing credentials, so any sit…
Never Let the Model Pick the Tenant ID: Securing an LLM Agent in Go
TL;DR : an LLM that calls tools is a client you cannot trust. And it holds your production credentials. The most important rule fits in one sentence…
Give Your Coding Agent a Deterministic Vulnerability Oracle
AI agents can write code, run tests, inspect dependencies, and open pull requests. But when they encounter a vulnerable package, their security reas…
Inter-Rater Agreement and Cohen's Kappa: When Your Labels Are Opinions
Two radiologists read the same 100 screening mammograms, each marking every scan "clear" or "suspicious." They agree on 92 of them. Cohen's kappa sc…
I Built What I Benchmark. Here's How I Try Not to Cheat.
On 2026-07-05, re-verifying the numbers before publishing the 17-plugin benchmark, eslint-plugin-unicorn came back 0 of 40 — a suspiciously clean ze…
Goodhart's Law in Benchmarking: When the Metric Becomes the Target
A benchmark score going up is not evidence that the thing it measures got better. In 2015, regulators found that roughly 11 million diesel cars were…
I Maintain 23 Benchmark Suites Across My Own Packages. Only 1 of the Serverless Ones Has Real Numbers Yet.
Five days earlier, an audit of my own ESLint plugins found 140 files still calling context.getFilename() , getSourceCode() , and getCwd() — three AP…
I caught a trojan in my MCP marketplace. Here's the 8-layer defense I built.
Two weeks ago, a Windows trojan slipped into my MCP (Model Context Protocol) marketplace. The malware was Trojan:Win64/Lazy.PGPK!MTB , hidden inside…
Audit BYOK Model Endpoints Before Your AI Agent Gets the Key
“Bring your own key” looks like a settings feature. For an AI coding agent, it is also a security boundary: a privileged workload will send reposito…
Falco on Kubernetes: Runtime Security with eBPF
Originally published on DevToolHub . Most Kubernetes security tools scan for misconfigurations — pods running as root, missing network policies, RBA…
Finding Exposed Services & Vulnerabilities: A Developer's Quick Guide with ScanSearch
Ever been in a situation where you need to quickly identify what services are exposed on a particular network range, or even across the internet? Ma…
Migrating from Terraform to OpenTofu, safely
Move an existing project, safely. Migrating from Terraform to OpenTofu is less an engine transplant than a badge swap. OpenTofu began as a line-for-…
Why Cursor Keeps Writing Prototype Pollution Into Your Merge Code
TL;DR AI editors love writing recursive merge helpers, and most of them are open to prototype pollution. One crafted JSON payload with a proto key c…