Tag: Developer Security
GitHub Widens the Door on Advanced Security Trials
Tom Smith | | AI coding, application security, CodeQL, Developer Security, devsecops, exposed credentials, GHAS, GitHub Advanced Security, GitHub Code Security, GitHub Enterprise Cloud, GitHub Secret Protection, GitHub security, mid-market security, Repository Security, secret scanning, secure software development, Software Supply Chain Security, vulnerability scanningGitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free ...
GitHub Puts Guardrails on Copilot’s Sandbox Inside JetBrains IDEs
Tom Smith | | AI agents, AI coding agents, AI Governance, Copilot sandbox, Developer Security, developer tools, Enterprise AI, filesystem controls, GitHub Copilot, GitHub Copilot JetBrains, IDE security, JetBrains, managed policies, MCP governance, network controls, OpenTelemetry, platform engineering, sandbox security, software developmentJetBrains IDEs are where a lot of enterprise backend work happens — Java, Kotlin, Spring, big monorepos with a lot to break. So when an AI coding agent starts running shell commands ...
Are LLMs Equally Good (or Bad) at Building Secure Software?
Pieter Danhieux | | agentic AI, AI agents, AI code security, AI coding assistants, AI coding costs, AI coding models, AI Development, AI model benchmarking, AI-generated code, application security, Developer Security, framework security, LLM security, OWASP Top 10, SAST, secure code generation, secure coding, software development, software security, token costsAn SCW study finds a large variance in how frontier and budget LLMs perform across different frameworks, and explains the striking cost variance ...
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
Why Developer Workstations Have Become a Critical Part of the Software Supply Chain
Samuel Ogbonna | | CI/CD security, Developer Security, Developer Workstations, devsecops, open source security, Software Supply ChainFor years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest that this view is incomplete. The Megalodon campaign injected malicious ...
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Jeff Burt | | AI coding agents, AI security risks, Anthropic Claude Code, Developer Security, exposed credentials, exposed secrets, Futurum Group, indirect prompt injection, leaked API keys, Mozilla 0DIN, shell scriptsA clean GitHub repository that contains no malicious code can launch an attack and fully compromise a developer’s systems by using indirect prompt injections to trick AI-powered coding agents like Anthropic’s Claude ...
Shift Left to the Developer’s Machine: Building Local Git Security Gates
Arun Sanna | | CI/CD security, code security, Credential Leakage, Defense in Depth, developer experience, Developer Security, devsecops, Git Hooks, Git Security, GitLeaks, Open Source Security Tools, Pre-Commit Hooks, secret detection, secrets management, shift left security, Software Supply Chain, static analysis, supply chain security, vulnerability scanningShift left to the developer's machine. The principle is what matters: Stop secrets before they ship. The tooling is a means to that end. ...
