Audit BYOK Model Endpoints Before Your AI Agent Gets the Key
“Bring your own key” looks like a settings feature. For an AI coding agent, it is also a security boundary: a privileged workload will send repository…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
- игры
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
claude
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
tutorial
typescript
webdev
Falco on Kubernetes: Runtime Security with eBPF
Originally published on DevToolHub . Most Kubernetes security tools scan for misconfigurations — pods running as root, missing network policies, RBAC …
Finding Exposed Services & Vulnerabilities: A Developer's Quick Guide with ScanSearch
Ever been in a situation where you need to quickly identify what services are exposed on a particular network range, or even across the internet? Mayb…
Migrating from Terraform to OpenTofu, safely
Move an existing project, safely. Migrating from Terraform to OpenTofu is less an engine transplant than a badge swap. OpenTofu began as a line-for-li…
Why Cursor Keeps Writing Prototype Pollution Into Your Merge Code
TL;DR AI editors love writing recursive merge helpers, and most of them are open to prototype pollution. One crafted JSON payload with a proto key can…
DevSecOps на практике: райтапы заданий с митапа CyberCamp глазами тех, кто их придумал
В марте состоялся второй эпизод DevSecOps-митапа CyberCamp, в программу которого вошли киберучения на платформе Jet CyberCamp. Три задания, максимальн…
Роадмап по информационной безопасности
Цивилизация... Какие у вас ассоциации с этим словом? А если написать его по-другому, например, на английском. Вот так - Civilization... Ядерный Ганди?…
Why Every CISO Needs an AIBOM in 2026 — And What Most Vendors Miss
A friend runs security at a mid-size fintech. Last month she got a Slack ping from her GRC lead: the EU AI Act auditor wanted a full inventory of AI s…
Shifting Mobile Security Left: Applying SAST to Android Apps with MobSF
TL;DR — I took an intentionally vulnerable Android application, ran the static analysis engine of MobSF (Mobile Security Framework) via a local Docker…
Applying SAST to Infrastructure as Code: Scanning Terraform with Checkov
Abstract Infrastructure as Code (IaC) has turned cloud infrastructure into source code — and, therefore, into a valid target for Static Application Se…
Your Phishing Simulation Score Is 99%. Here's Why That Worries Me.
The 2025 Verizon DBIR has a number that should change how you think about security training budgets. The median phishing click rate after years of rep…
Your Infrastructure Has Bugs Too: Scanning Terraform with Checkov (IaC SAST)
TL;DR: Application code isn't the only thing that ships vulnerabilities — your Terraform does too. I wrote an intentionally insecure AWS configuration…
Autonomous pentesting against Active Directory, without the black box
Active Directory is where most internal compromises happen and where most AI tools give up. Darkmoon runs the AD attack path autonomously and shows ev…
Why evidence matters more than model memory in AI pentesting
An AI finding you cannot reproduce is a liability, not a result. Darkmoon attaches the exact commands and raw tool output to every finding so a human …
Why Cursor Keeps Hashing Passwords With MD5 (And How to Fix It)
TL;DR AI editors still reach for md5/sha1 to hash passwords because that is what a decade of tutorials taught them Fast hashes are the whole problem: …
SAST vs SCA: why your CI pipeline needs both
When security teams talk about "scanning" code in CI/CD, they usually mean one of two very different things: scanning the code you wrote (SAST) or sca…
Best DevSecOps Security Tools for CI/CD Pipeline Protection
I've spent twenty-five years building and securing deployment pipelines, and the single biggest shift in that time isn't a tool — it's where security …
DevOps Security Best Practices Every Engineering Team Should Follow
I've spent 25 years securing Linux boxes, cloud accounts, CI/CD pipelines, and production clusters. The single most consistent lesson across all of it…
78% False Negatives: Your AI Security Scanner Is Gaslighting You
False negatives automated scanning tools are the silent killers in your security posture—they're the critical threats that slip past your defenses wit…
Best Practices по GitLab CI/CD: от workflow:rules и кеша до OIDC, BuildKit, ревью-окружений и безопасных раннеров
Статья получилась большой: практик много, и каждая из них важна по-своему. Я собрал материал как набор best practices: не все пункты нужны каждому про…
DevSecOps Automation: A Deep Dive into SAST
In the era of Artificial Intelligence as a work buddy, it is imperative that security is enforced as development progresses. It could be tempting to t…
Nation-State Actors Are Now Targeting Your AI Agent's npm Packages
This article was originally published on LucidShark Blog . On June 17, 2026, Microsoft Threat Intelligence published a report attributing a supply cha…
«РБПО для бедных»: настраиваем резервное копирование
В прошлой статье мы завершили сборку конвейера безопасной разработки: настроили GitLab CI/CD, подключили Vault для безопасной работы с секретами, доба…
DevSecOps Explained: Embedding Security into Every Deployment
Modern software delivery moves at extraordinary speed. Organizations deploy dozens, hundreds, or even thousands of times each day. While this accelera…
Why Every CISO Needs an AIBOM in 2026 — And What Vendors Miss
A friend of mine runs security at a mid-sized fintech. About six weeks ago she called me, mildly furious, because her board had asked a question she c…
Who Actually Owns This Service Account?
When that AWS service account gets compromised, who do you call? A question that shouldn't be hard. If you're in security or platform engineering, you…
One "Fix This Code" Prompt Away from a Production Incident
This article was originally published on LucidShark Blog . A developer opened their AI coding tool, pasted in a critical authentication module, and ty…
«РБПО для бедных»: собираем CI/CD-конвейер безопасной разработки
В прошлой статье мы завершили настройку нашего стенда РБПО: подготовили GitLab и GitLab Runner, настроили Nexus, Vault, DefectDojo и Dependency-Track,…
Secret Scanning in CI: What Pre-Commit, Pull Request, and Main Branch Each Actually Catch
A teammate pastes an AWS access key into a PR comment to "debug quickly." Another commits .env.production because .gitignore was wrong on a new micros…
DevSecOps: Integrating Security into Your CI/CD Pipeline
Security as an afterthought doesn't work. Finding a critical vulnerability in production costs 100x more than catching it during development. DevSecOp…