Continuous Security Testing for Small Teams: What to Test, How Often, and Who Owns It
Small teams rarely have a security department. They have a few developers, maybe a team lead, and sometimes an MSP that looks after the infrastructu…
Open Source
⚑ Сообщить о проблемеПоследние новости Open Source от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
AI Agent Security: Six Controls From Nine Real Incidents
TL;DR Three attack surfaces: An AI agent exposes its host, its identity, and itself. Nine public incidents between May 2025 and July 2026 hit all th…
AI Hooks for Claude Code, Cursor, and Codex: Block Secrets Before Agents Can Use Them
TL;DR Instructions are suggestions, not controls : Prompts, AGENTS.md, and CLAUDE.md files only guide an agent, which can reinterpret or route aroun…
GSC: A Self-Learning SAST That Proves Vulnerabilities, Fixes Them, and Learns From Your Feedback
TL;DR — GSC (Git Security Checker) is a self-learning AppSec platform that doesn't stop at detecting a vulnerability. It proves it with a sandboxed…
MITRE ATT&CK для Product Security: как связать pentest, threat modeling, CI/CD и реальные сценарии атак
Матрицу MITRE ATT&CK обычно ассоциируют с SOC, threat hunting и red team. Это база. Но она может быть полезна намного раньше — на этапе threat m…
DevSecOps Automation II: A Deep Dive into DAST
In the first part of this series , we looked at Static Application Security Testing (SAST) — scanning source code without executing the application;…
A free, anonymous Snyk alternative for dependency scanning
If you've shopped for Software Composition Analysis (SCA), you've hit the same wall: the good tools (Snyk, Black Duck, Mend, JFrog Xray) want an acc…
CVSS, EPSS and KEV: how to actually prioritize dependency vulnerabilities
Every week a dependency scanner finds dozens of vulnerabilities. Every week most developers ignore them, because there's no time to fix 200 issues a…
AI Agents vs Traditional Automation: What's Actually Different for Security
The real security difference between an AI agent and traditional automation is not "smart vs dumb". It is where control over execution lives : in co…
The Artifactory Token Chain: Why Build Repositories Are a Credential Store
The Artifactory Token Chain: Why Build Repositories Are a Credential Store An artifact repository is rarely described as a credential store, yet tha…
Security Telemetry on a Budget: Building a Practical Elastic Baseline for a Growing Product Team
Security Telemetry on a Budget How a growing product team turned the Elastic stack it already had into a practical security telemetry baseline — wit…
The AI Race Has a Missing Question: Can We Explain What Our Agents Already Did?
The public conversation around advanced AI often collapses into two positions. One side says we should slow down. The other says progress is inevita…
Agentic AI Security: Credentials and Permissions Define the Blast Radius
Agentic AI Security: Credentials and Permissions Define the Blast Radius Prompt injection can't be patched away. Three 2026 agentic AI incidents sho…
Ваш test — это prod
Просто вы его так не назвали. Открытый стандарт EnvSpec Naming 1.0 — о том, что имя ресурса это модель доверия, а не удобство админа. Стенд UAT с бо…
Harden & Lockdown RKE2 Cluster with a 4-Layer DevSecOps Stack
Introduction Before you move furniture into a new house, you install the locks, the cameras, and the gates. Kubernetes is no different, yet engineer…
`gh attestation verify` said yes to an image we never released
The four questions, and the one nobody asks Pulling a container image somebody else built asks four separate questions. Most people answer three of…
Your AI Agents Are Using Your Credentials
Key findings It's a secrets problem before it's an identity problem. Many AI agents don't have their own distinct identity, so they operate using AP…
Vault Coverage Is the Missing Metric in NHI Programs
Most large enterprises have some version of a vault program, the combination of policy, platform, process, and ownership used to manage machine cred…
CVE: история о том, как два инженера устали от хаоса и создали идентификатор, связавший все уязвимости мира
Одна уязвимость, дюжина названий, 321 запись и стенд, за которым конкуренты договорились “дружить”. История создания самого известного идентификатор…
What Happens When You pip install a Malicious Python Package?
A developer runs pip install. Nothing crashes. No ransomware appears. No antivirus alert fires. Thirty seconds later, a Python process makes an outb…
Building a "Fail-Closed" Zero-Trust CI/CD Protocol: A Personal Open-Source Experiment
Hello, Dev community! 👋 I am Anjo Machina (安城巻那), a QA engineer based in Japan. I want to share an open-source project I have been building. It is a…
What Was on This Machine? Answering the Blast Radius Question After a Laptop Compromise
TL;DR: The containment clock starts immediately after a developer's laptop is compromised, an infostealer fires an alert, a device goes missing, or…
Beyond free-roaming Agents: Architecting a Deterministic 4-node Graph pipeline for zero-false-positive Autonomous VAPT
Beyond Free-Roaming Agents: Architecting a Deterministic 4-Node Graph Pipeline for Zero-False-Positive Autonomous VAPT Every AppSec engineer eventua…
Судьба в пайплайне: пишем детерминированный Quality Gate на Go с механикой Таро
В рамках этой статьи расскажу, как реализовалась идея о псевдорандоме и магии внутри пайплайна, и как я выложил инструмент котор…
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
Чем опасны старые версии Nexus Repository CE
Хранилище артефактов, как правило, находится в критическом месте инфраструктуры компании: между сборкой продукта и внешним миром. Через него команды…
CVE-2026-35603: Cursor Still Trusts a World-Writable Folder
TL;DR Claude Code, Cursor, Codex CLI and Gemini CLI on Windows all load machine-wide configuration from C:\ProgramData\ , a folder any standard user…
drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner (2026 Benchmark)
drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner Benchmarked on 500+ web3 repositories. Generic scanners miss 73% of web3-…
Как взрослеет DevOps на потоке: от информирующих сканов к risk-based gate'ам
Привет, Хабр! На связи Илья Виссарионов, директор департамента «Аппаратно‑системная платформа» компании «Диасофт». Про DevSecOps написаны тон…
Building a Read-Only Cloudflare Worker AI Security Console
Why build this Security teams already have WAF events, bot signals, access logs, and SIEM pipelines. The problem is not always data collection. The…