Tag: #devsecops

한국어English日本語中文

← All posts

• The 3-Hour axios Account Takeover — Provenance Was On, and Nobody Checked It

  At 00:21 UTC on March 31, 2026, a malicious version 1.14.1 landed on axios, a package with over 80 million weekly downloads. What makes this case interesting is that axios was already using npm trusted publishing — the l

  2026-07-16 · 18 min read #security#supply-chain#npm#nodejs#devsecops

• Why npm supply-chain attacks won't go away — what npm-scan actually checks, and the defenses that work

  npm supply-chain attacks are not isolated accidents but a recurring product of install scripts, transitive dependencies, and typosquatting. In 2025 the Shai-Hulud worm self-replicated through install scripts and harveste

  2026-07-11 · 7 min read #npm#supply-chain#security#javascript#nodejs

• Cloud Security 2026 Complete Guide - Zero Trust, SBOM/SLSA, CSPM/CNAPP, Wiz, Falco, Sigstore, Vault, Tailscale, Cloudflare Deep Dive

  A complete look at the cloud security stack as of May 2026. Zero Trust (Cloudflare, Tailscale, Zscaler, Netskope), CSPM/CNAPP (Wiz, Orca, Lacework, Prisma Cloud, Sysdig, Aqua), SBOM/SLSA supply chain (Sigstore cosign, Cy

  2026-05-16 · 22 min read #cloud-security#zero-trust#sbom#slsa#cspm

• Static Analysis / SAST 2026 — Semgrep / CodeQL / Snyk / SonarQube / Aikido / Trivy Deep Dive

  Mapping the 2026 code security tooling landscape — Semgrep (the de facto OSS SAST plus Pro engine and Supply Chain), CodeQL (the heart of GitHub Advanced Security, dataflow king), Snyk Code (SAST+SCA after the DeepCode A

  2026-05-15 · 26 min read #security#sast#static-analysis#semgrep#codeql

• Application Security Engineering Guide — OWASP Top 10, Authentication, Encryption, DevSecOps

  Everything about application security: OWASP Top 10 vulnerabilities, secure authentication/authorization, practical encryption, secure coding, and DevSecOps pipelines.

  2026-04-13 · 16 min read #ai#security#owasp#authentication#encryption

• The Complete DevSecOps Guide 2025: Shift-Left Security, SAST/DAST/SCA, Container Security

  Everything about DevSecOps! Shift-Left security strategy, SAST (SonarQube/Semgrep), DAST (ZAP/Burp), SCA (Snyk/Dependabot), Container security (Trivy), Supply chain security (SBOM/SLSA), Secret detection, GitHub Actions

  2026-03-24 · 20 min read #devsecops#security#shift-left#sast#dast