Babak Rahimi·21h agoTrust Before You Pull: Inside Sophilia’s Safe RegistryEvery engineer pulls a database, a model runtime, or a vector store onto their laptop. We made sure the one they pull has already been…
Kaif Mohammed Khan·1d agoArchitecting Resilience: From Git Commit to GitOps Continuous Deployment, Zrok Tunnelling, and…The modern software delivery lifecycle often fractures at the boundary between Continuous Integration (CI) and Continuous Deployment (CD)…
Kenneth chinedu·2d agoThreat Modeling a GitHub Actions Pipeline: Where the Secrets Actually LeakA platform security engineer’s walkthrough: one data flow diagram, two trust boundaries, two threats worth fixing everywhere.
Zachary Cater·3d agoMy Takeaways on npm and GitHub ActionsAfter reading “Disrupting supply chain attacks on npm and GitHub Actions, by Greg Ose and Zachary Steindler,” I have a better understanding…
Kiran Yenaganti·4d agoDeprecated MCP Servers: Why AI Coding Agents Install Packages That Will Never Be PatchedMCPhantom shows that a model’s memory is choosing your dependencies. Here is where a runtime check should step in.
InSkill StuffbyCodeTune·5d agoA Compression Bug in Node.js Became a Security Problem Far Beyond JavaScriptOne vulnerable Brotli decoder crossed Node.js, Python, .NET, Java, Bun, Envoy, and Istio, exposing how much supposedly separate software…
Sudipto K Haldar·5d agoShipping an MCP Server, Part IV: Automate Releases with No SecretsA pushed tag that becomes a PyPI release and a Registry listing, with no credential stored anywhereA response icon1A response icon1
InSkill StuffbyCodeTune·5d agoAttackers Didn’t Bypass the Security Tool. They Used Its Update PathIf software can update itself as root, the updater is part of your production security architecture.A response icon1A response icon1
InGoverned at the SourcebyAbby Kearns·6d agoMCP Inspector Security Advisories: Why AI Agent Developer Tools Belong in Your Dependency InventoryThe tool for checking an MCP server was exposed to the server it was checking.
Venkatramanan Vijayan·Oct 30Never-ending October 2026: when Cybersecurity Awareness Month became Cybersecurity Reality MonthOctober is Cybersecurity Awareness Month. This year, the month ran its own live exercise on why the awareness posters never quite cover the…A response icon1A response icon1
