.avif)
Welcome to our blog.
PromptPwnd: Prompt Injection Vulnerabilities in GitHub Actions Using AI Agents
AI-driven GitHub Actions expose new prompt-injection supply chain vulnerabilities.
2026 State of AI in Security & Development
Our new report captures the voices of 450 security leaders (CISOs or equivalent), developers, and AppSec engineers across Europe and the US. Together, they reveal how AI-generated code is already breaking things, how tool sprawl is making security worse, and how developer experience is directly tied to incident rates. This is where speed and safety collide in 2025.
Customer Stories
See how teams like yours are using Aikido to simplify security and ship with confidence.
Compliance
Stay ahead of audits with clear, dev-friendly guidance on SOC 2, ISO standards, GDPR, NIS, and more.
Guides & Best Practices
Actionable tips, security workflows, and how-to guides to help you ship safer code faster.
DevSec Tools & Comparisons
Deep dives and side-by-sides of the top tools in the AppSec and DevSecOps landscape.
OWASP Top 10 for Agentic Applications (2026): What Developers and Security Teams Need to Know
Learn the OWASP Top 10 for Agentic Applications. Understand the top AI agent security risks, real-world examples, and how to harden your environment.
SCA Everywhere: Scan and Fix Open-Source Dependencies in Your IDE
Bring the full SCA workflow into your IDE with in-editor scanning and AutoFix. Detect vulnerable packages, review CVEs, and apply safe upgrades without leaving your development workflow.
Safe Chain now enforces a minimum package age before install
Safe Chain now enforces a minimum 24-hour package age to stop attackers using fresh releases as an entry point. Blocks malware early and falls back to safe versions.
CORS Security: Beyond Basic Configuration
Learn what CORS really is, how browsers enforce it, and how to configure cross-origin requests securely. A practical guide to avoiding common CORS issues.
Secrets Detection: A Practical Guide to Finding and Preventing Leaked Credentials
Learn how secret detection works, what counts as a secret (API keys, tokens, creds), where teams leak them, and how to prevent exposure in git, CI, and production.
AI as a Power Tool: How Windsurf and Devin Are Changing Secure Coding
Learn how Windsurf and Devin help developers code faster and stay secure. Real takeaways from Aikido’s Security Masterclass for AI-assisted coding.
Building Fast, Staying Secure: Supabase’s Approach to Secure-by-Default Development
Supabase CISO Bill Harmer and Security Engineer Etienne Stalmans share how security is built into every layer of Supabase. From Row Level Security to pgTAP testing, learn how they design systems that move fast and stay secure by default.
The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties
Threat actors are using Unprintable Unicode Characters to
What Is IaC Security Scanning? Terraform, Kubernetes & Cloud Misconfigurations Explained
Understand IaC security scanning: how it detects cloud misconfigurations in Terraform/Kubernetes, what to prioritize, and how to prevent risky changes before deploy.
What Is CSPM (and CNAPP)? Cloud Security Posture Management Explained
A clear breakdown of CSPM and CNAPP: what they cover, how they reduce cloud risk, key features to look for, and how teams actually adopt them.
Reducing Cybersecurity Debt with AI Autotriage
We dive into how AI can assist us in a meaningful way to triage vulnerabilities and get rid of our security debt.
Shai Hulud 2.0: What the Unknown Wonderer Tells Us About the Attackers’ Endgame
New research into the Shai Hulud 2.0 malware suggests the username UnknownWonderer1 tells us more about the attackers’ endgame.
Shai Hulud Attacks Persist Through GitHub Actions Vulnerabilities
Shai Hulud threat actors are leveraging GitHub Actions vulnerabilities in an ongoing exploitation campaign. Discover the impact and recommended security measures.
Shai Hulud Launches Second Supply-Chain Attack: Zapier, ENS, AsyncAPI, PostHog, Postman Compromised
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
Top 12 Dynamic Application Security Testing (DAST) Tools in 2026
Discover the 12 top best Dynamic Application Security Testing (DAST) tools in 2026. Compare features, pros, cons, and integrations to choose the right DAST solution for your DevSecOps pipeline.
SAST vs DAST: What you need to know.
Get an overview of SAST vs DAST, what they are, how to use them together, and why they matter for your application security.
Get secure now
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
.avif)
