DevSecOps best practices and breach lessons

How npm trusted publishing works: short-lived OIDC instead of npm tokens, automatic provenance, setup fields, requirements, and what it does not stop.

How to respond to a software supply chain incident: find every build and machine that ran the bad package, rotate secrets in the right order, check whether your own releases were tampered with, and tell downstream users when they were.

The October 2026 LiteLLM GitHub-identity compromise, as reported, step by step, and the GitHub control that would have ended the chain at each point.

A plain-English explainer on Application Security Posture Management (ASPM): what it is, why it emerged from application-security tool sprawl, how it correlates and deduplicates findings from SAST, DAST, SCA and secret scanners, how ASPM differs from CNAPP, and what a good ASPM program actually delivers.

A practical explainer on Dynamic Application Security Testing (DAST): what black-box runtime scanning is, how DAST differs from SAST, IAST and SCA, its strengths and limits, where it fits in CI/CD, and how to get useful results without drowning in false positives.

NIST SSDF (SP 800-218) explained: the four practice groups, all 19 practices by ID, how it maps onto your SDLC, and what federal SSDF attestation asks for.

CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in self-managed GitLab CE/EE 7.0+, fixed 21 Oct 2026 in 19.5.1 and backports. The 12 Oct fix isn't enough.

Muxin runs AI coding agents across all your machines from one window. Useful, but it concentrates shell access in one app. The risks and safe use.

Want an application security free trial? Start with 6 free tools (Semgrep, ZAP, Trivy, Dependabot, Gitleaks, TruffleHog), then test vendors properly.

Claude Security is a new beta plugin that scans code changes or entire repos for high-severity vulnerabilities directly in the terminal — reasoning through data flows like a security researcher instead of pattern-matching, with adversarial self-checks to cut false positives. Here's how it works and what it means for AppSec teams.

GitHub rulesets vs classic branch protection rules: layering, bypass lists, org-wide scope, tags, and how to set required status checks. A security checklist.