Deep technical dives on application security, infrastructure scanning, SAST, secrets management, and the mechanics of building secure software pipelines — no marketing fluff.
Most IaC scanners run against your working directory — but Terraform modules sourced from Git are fetched at terraform init time, in the wrong place, or never at all.
npm audit only reads your lockfile. It has no idea about the jQuery 1.11 sitting in your static folder since 2015. Here is what it misses and how to actually find it.
Untrusted input flowing through ${{ github.event.issue.title }} into shell commands is a class of injection that static analysers routinely overlook.
Rotating a leaked key in your current branch does nothing to the commit SHA where it lived. Here is how attackers recover rotated secrets from public repositories — and how to actually remediate.
A CVE in a direct dependency gets patched. The vulnerable version stays in your lockfile via an indirect transitive path your scanner never flags.
Admission webhooks that fail-open during outages create a narrow window where unsigned, unscanned images bypass your entire security policy chain.
Modern prototype pollution chains through gadgets in popular frameworks in ways that rule-based SAST engines simply cannot model. Here is the gap.
We publish one deep-dive per month on application security, IaC scanning, DevSecOps tooling, and vulnerability research. Engineers only.