От Security Champion к инженерной культуре безопасности: как мы изменили подход к DevSecOps
Модель Security Champion многим кажется очевидной: если внутри команды появляется человек, который смотрит на продукт еще и с точки зрения безопасност…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
career
claude
cybersecurity
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
Confronting Vault Sprawl And The Risks It Brings
Modern enterprises do not set out to create a maze of credentials, keys, and secrets stores. However, this is the reality most organizations find them…
Why Cursor Keeps Generating Wildcard CORS Headers in Your API
TL;DR AI editors keep generating CORS middleware that reflects the request's Origin header back verbatim while also allowing credentials, so any site …
Never Let the Model Pick the Tenant ID: Securing an LLM Agent in Go
TL;DR : an LLM that calls tools is a client you cannot trust. And it holds your production credentials. The most important rule fits in one sentence. …
Мост между SAST и фаззингом: как из сработки SAST получить подтверждённую уязвимость
Инструменты статического анализа (SAST) лишь подсвечивают вероятные уязвимости, генерируя гипотезы. Динамическое тестирование (DAST) и фаззинг, напрот…
Inter-Rater Agreement and Cohen's Kappa: When Your Labels Are Opinions
Two radiologists read the same 100 screening mammograms, each marking every scan "clear" or "suspicious." They agree on 92 of them. Cohen's kappa scor…
I Built What I Benchmark. Here's How I Try Not to Cheat.
On 2026-07-05, re-verifying the numbers before publishing the 17-plugin benchmark, eslint-plugin-unicorn came back 0 of 40 — a suspiciously clean zero…
Goodhart's Law in Benchmarking: When the Metric Becomes the Target
A benchmark score going up is not evidence that the thing it measures got better. In 2015, regulators found that roughly 11 million diesel cars were r…
I Maintain 23 Benchmark Suites Across My Own Packages. Only 1 of the Serverless Ones Has Real Numbers Yet.
Five days earlier, an audit of my own ESLint plugins found 140 files still calling context.getFilename() , getSourceCode() , and getCwd() — three APIs…
I caught a trojan in my MCP marketplace. Here's the 8-layer defense I built.
Two weeks ago, a Windows trojan slipped into my MCP (Model Context Protocol) marketplace. The malware was Trojan:Win64/Lazy.PGPK!MTB , hidden inside a…
Audit BYOK Model Endpoints Before Your AI Agent Gets the Key
“Bring your own key” looks like a settings feature. For an AI coding agent, it is also a security boundary: a privileged workload will send repository…
Falco on Kubernetes: Runtime Security with eBPF
Originally published on DevToolHub . Most Kubernetes security tools scan for misconfigurations — pods running as root, missing network policies, RBAC …
Роадмап по информационной безопасности
Цивилизация... Какие у вас ассоциации с этим словом? А если написать его по-другому, например, на английском. Вот так - Civilization... Ядерный Ганди?…
Why Every CISO Needs an AIBOM in 2026 — And What Most Vendors Miss
A friend runs security at a mid-size fintech. Last month she got a Slack ping from her GRC lead: the EU AI Act auditor wanted a full inventory of AI s…
Shifting Mobile Security Left: Applying SAST to Android Apps with MobSF
TL;DR — I took an intentionally vulnerable Android application, ran the static analysis engine of MobSF (Mobile Security Framework) via a local Docker…
Applying SAST to Infrastructure as Code: Scanning Terraform with Checkov
Abstract Infrastructure as Code (IaC) has turned cloud infrastructure into source code — and, therefore, into a valid target for Static Application Se…
Your Infrastructure Has Bugs Too: Scanning Terraform with Checkov (IaC SAST)
TL;DR: Application code isn't the only thing that ships vulnerabilities — your Terraform does too. I wrote an intentionally insecure AWS configuration…
Autonomous pentesting against Active Directory, without the black box
Active Directory is where most internal compromises happen and where most AI tools give up. Darkmoon runs the AD attack path autonomously and shows ev…
Why evidence matters more than model memory in AI pentesting
An AI finding you cannot reproduce is a liability, not a result. Darkmoon attaches the exact commands and raw tool output to every finding so a human …
SAST vs SCA: why your CI pipeline needs both
When security teams talk about "scanning" code in CI/CD, they usually mean one of two very different things: scanning the code you wrote (SAST) or sca…
Best DevSecOps Security Tools for CI/CD Pipeline Protection
I've spent twenty-five years building and securing deployment pipelines, and the single biggest shift in that time isn't a tool — it's where security …
DevOps Security Best Practices Every Engineering Team Should Follow
I've spent 25 years securing Linux boxes, cloud accounts, CI/CD pipelines, and production clusters. The single most consistent lesson across all of it…
78% False Negatives: Your AI Security Scanner Is Gaslighting You
False negatives automated scanning tools are the silent killers in your security posture—they're the critical threats that slip past your defenses wit…
DevSecOps Automation: A Deep Dive into SAST
In the era of Artificial Intelligence as a work buddy, it is imperative that security is enforced as development progresses. It could be tempting to t…
«РБПО для бедных»: настраиваем резервное копирование
В прошлой статье мы завершили сборку конвейера безопасной разработки: настроили GitLab CI/CD, подключили Vault для безопасной работы с секретами, доба…
DevSecOps Explained: Embedding Security into Every Deployment
Modern software delivery moves at extraordinary speed. Organizations deploy dozens, hundreds, or even thousands of times each day. While this accelera…
One "Fix This Code" Prompt Away from a Production Incident
This article was originally published on LucidShark Blog . A developer opened their AI coding tool, pasted in a critical authentication module, and ty…
«РБПО для бедных»: собираем CI/CD-конвейер безопасной разработки
В прошлой статье мы завершили настройку нашего стенда РБПО: подготовили GitLab и GitLab Runner, настроили Nexus, Vault, DefectDojo и Dependency-Track,…
Secret Scanning in CI: What Pre-Commit, Pull Request, and Main Branch Each Actually Catch
A teammate pastes an AWS access key into a PR comment to "debug quickly." Another commits .env.production because .gitignore was wrong on a new micros…
DevSecOps: Integrating Security into Your CI/CD Pipeline
Security as an afterthought doesn't work. Finding a critical vulnerability in production costs 100x more than catching it during development. DevSecOp…