DevSecOps

Bearer CLI: Free, source-available code security scanning tool (SAST)

Application Security, Bearer, DevSecOps, Don't miss, GitHub, News, penetration testing, scanner, software /

Bearer CLI: Free, source-available code security scanning tool (SAST) 2026-10-19 at 08:30 By Anamarija Pogorelec Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, […]

Bearer CLI: Free, source-available code security scanning tool (SAST) Read More »

GitHub adopts cheaper AI model to catch secrets developers leave in code

agentic AI, code, credentials, cybersecurity, DevSecOps, GitHub, News, scanning /

GitHub adopts cheaper AI model to catch secrets developers leave in code 2026-10-14 at 12:26 By Anamarija Pogorelec GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and model serving costs by more than 98% compared with its […]

GitHub adopts cheaper AI model to catch secrets developers leave in code Read More »

GitHub adds AI to catch passwords before a code push

agentic AI, AI, code, credentials, cybersecurity, DevSecOps, GitHub, News /

GitHub adds AI to catch passwords before a code push 2026-10-08 at 12:02 By Anamarija Pogorelec GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. The ModernBERT-based classifier will expand GitHub’s push protection, which checks code for secrets and can […]

GitHub adds AI to catch passwords before a code push Read More »

Keyorix: Open-source secrets management for teams that can’t use SaaS

cybersecurity, data management, DevOps, DevSecOps, Don't miss, GitHub, Hot stuff, News, open source, software /

Keyorix: Open-source secrets management for teams that can’t use SaaS 2026-10-05 at 08:00 By Anamarija Pogorelec Keyorix is an open-source secrets manager that runs entirely on a company’s own servers. A secrets manager is the locked store where an application fetches the database passwords, API keys, and tokens it needs, so they stay out of […]

Keyorix: Open-source secrets management for teams that can’t use SaaS Read More »

Permify: Open-source authorization as a service

DevSecOps, Don't miss, GitHub, News, open source, software /

Permify: Open-source authorization as a service 2026-09-14 at 08:30 By Sinisa Markovic Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit. It keeps those rules in one place, apart from the application code that would otherwise carry […]

Permify: Open-source authorization as a service Read More »

Your threat feed is someone else’s database: What ingesting malware intel at scale takes

cybersecurity, DevSecOps, Don't miss, Expert analysis, GitHub, Hot stuff, News, opinion, Threat Intelligence /

Your threat feed is someone else’s database: What ingesting malware intel at scale takes 2026-09-03 at 08:30 By Help Net Security The advice is to consume shared threat intelligence. Join the ISAC. Wire the community feeds into your pipeline. This looks like a fine advice and I agree to it. What nobody mentions you is […]

Your threat feed is someone else’s database: What ingesting malware intel at scale takes Read More »

AI supply chain risk is showing up in developer workflows first

agentic AI, AI, CXO, DevSecOps, Don't miss, Features, Hot stuff, News, strategy, supply chain attacks, tips, Zentera Systems, zero trust /

AI supply chain risk is showing up in developer workflows first 2026-08-25 at 09:00 By Mirko Zorz In this Help Net Security interview, Dr. Jaushin Lee, CEO of Zentera Systems, discusses where AI supply chain risk shows up. He says most incidents still hit developer workflows and open-source package repositories, while poisoned model weights and […]

AI supply chain risk is showing up in developer workflows first Read More »

GitHub Dependabot malware alerts now cover eight ecosystems

DevSecOps, GitHub, News, open source, supply chain /

GitHub Dependabot malware alerts now cover eight ecosystems 2026-08-10 at 10:01 By Mirko Zorz GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no such warning, because GitHub’s malware detection only ever watched one ecosystem. That changed this month. […]

GitHub Dependabot malware alerts now cover eight ecosystems Read More »

Three in four AI-generated vulnerability patches leave something broken

1Password, agentic AI, AI, CVE, DevSecOps, Don't miss, Hot stuff, News, OpenAI, patching, research, Trail of Bits, vulnerability assessment /

Three in four AI-generated vulnerability patches leave something broken 2026-08-06 at 15:45 By Mirko Zorz Ask a frontier model to patch a real vulnerability and it will hand you something that looks like a fix. It reads like the patch a maintainer would write. When there is a test, it often passes. Roughly one time […]

Three in four AI-generated vulnerability patches leave something broken Read More »

The AI code vulnerabilities that grow with your app

AI, automation, code analysis, cybersecurity, DevSecOps, Don't miss, News, report, Theori, vulnerability assessment /

The AI code vulnerabilities that grow with your app 2026-07-23 at 07:30 By Mirko Zorz Theori built 28 apps with AI coding agents and scanned each one through its pentesting platform. Five models did the building, split between Anthropic and OpenAI, across apps written from a spec, thrown together from a casual prompt, and rewritten […]

The AI code vulnerabilities that grow with your app Read More »

Why SBOMs, signing, and provenance still don’t tell you if software is safe

cybersecurity, DevSecOps, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, strategy, zero trust /

Why SBOMs, signing, and provenance still don’t tell you if software is safe 2026-07-13 at 09:30 By Help Net Security We have made real progress in software supply chain security, improving visibility into software components, authenticity and build integrity. Much of this progress traces back to Executive Order 14028, which pushed agencies, contractors and enterprises […]

Why SBOMs, signing, and provenance still don’t tell you if software is safe Read More »

The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects

Chainguard, cybersecurity, DevSecOps, Don't miss, News, open source, vulnerability management /

The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects 2026-06-17 at 12:42 By Mirko Zorz Chainguard launched Athena, an industry coalition that pools open source vulnerability findings and remediates them under embargo before public disclosure. The group went live with more than two dozen member organizations. Founding members include BNY, Chainguard, […]

The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects Read More »

7 hard truths security pros should know: 2026 DevOps Threats Report

authentication, Cloud, DevOps, DevSecOps, Don't miss, Expert analysis, Expert corner, GitProtect.io, News, threats /

7 hard truths security pros should know: 2026 DevOps Threats Report 2026-05-20 at 09:34 By Help Net Security In 2025, trusted Git hosting platforms became a playground for cyber criminals. This is the main conclusion from the latest “DevOps Threat Unwrapped Report 2026” by GitProtect. If you want to effectively counter attacks targeted at your […]

7 hard truths security pros should know: 2026 DevOps Threats Report Read More »

HEIDI: Free IDE security plugin for open-source vulnerability checks

Connecting Software, DevSecOps, Don't miss, LLMs, News, programming, software, software development, supply chain /

HEIDI: Free IDE security plugin for open-source vulnerability checks 2026-05-12 at 09:28 By Mirko Zorz Open-source dependencies make up a large percentage of the code in production applications, and most vulnerability checks still run late in the pipeline, inside CI/CD systems or after a release ships. Meterian is moving those checks earlier with HEIDI, a […]

HEIDI: Free IDE security plugin for open-source vulnerability checks Read More »

One keypress is all it takes to compromise four AI coding tools

AI, Anthropic, Cursor, cybersecurity, DevSecOps, Don't miss, Features, GitHub, Google, Hot stuff, Microsoft, News, research, vulnerability /

One keypress is all it takes to compromise four AI coding tools 2026-05-08 at 01:14 By Mirko Zorz Developers clone unfamiliar repositories all the time. Open-source projects, work from teammates, sample code from a tutorial, a library someone recommended on a forum. The convention is old and reasonable: you look at what’s inside before you […]

One keypress is all it takes to compromise four AI coding tools Read More »

Amazon sends AI agents into pen testing and DevOps

agentic AI, Artificial Intelligence, AWS, cybersecurity, DevSecOps, News /

Amazon sends AI agents into pen testing and DevOps 2026-03-31 at 20:31 By Sinisa Markovic Amazon’s latest AI capabilities bring on-demand penetration testing through the AWS Security Agent, alongside the AWS DevOps Agent. “These agents are changing the way we secure and operate software. AWS Security Agent compresses penetration testing timelines from 2-6 weeks to […]

Amazon sends AI agents into pen testing and DevOps Read More »

Betterleaks: Open-source secrets scanner

Aikido Security, DevSecOps, Don't miss, GitHub, Hot stuff, News, open source, scanner, scanning, software /

Betterleaks: Open-source secrets scanner 2026-03-19 at 09:02 By Anamarija Pogorelec Secrets scanning has become standard practice across engineering organizations, and Gitleaks has been one of the most widely used tools in that space. The author of that project has now released a new tool called Betterleaks, which is designed to scan git repositories, directories, and […]

Betterleaks: Open-source secrets scanner Read More »

Your dependencies are 278 days out of date and your pipelines aren’t protected

CISO, cyber risk, cybersecurity, Datadog, DevSecOps, Don't miss, News, report, survey /

Your dependencies are 278 days out of date and your pipelines aren’t protected 2026-03-02 at 09:00 By Mirko Zorz Applications continue to ship with known weaknesses even as development workflows speed up. A new Datadog State of DevSecOps 2026 report examines how dependency management and pipeline practices are influencing exposure across cloud native environments. Across […]

Your dependencies are 278 days out of date and your pipelines aren’t protected Read More »

Bandit: Open-source tool designed to find security issues in Python code

code analysis, cybersecurity, DevSecOps, Don't miss, GitHub, News, open source, Python, scanning, software /

Bandit: Open-source tool designed to find security issues in Python code 2026-01-21 at 08:04 By Sinisa Markovic Bandit is an open-source tool that scans Python source code for security issues that show up in everyday development. Many security teams and developers use it as a quick way to spot risky coding patterns early in the […]

Bandit: Open-source tool designed to find security issues in Python code Read More »

CISO Assistant: Open-source cybersecurity management and GRC

CISO, Compliance, cybersecurity, DevSecOps, Don't miss, framework, GitHub, GRC, Hot stuff, News, open source, Risk Management, software, strategy /

CISO Assistant: Open-source cybersecurity management and GRC 2026-01-14 at 13:25 By Mirko Zorz CISO Assistant is an open-source governance, risk, and compliance (GRC) platform designed to help security teams document risks, controls, and framework alignment in a structured system. The community edition is maintained as a self-hosted tool for organizations that want direct access to […]

CISO Assistant: Open-source cybersecurity management and GRC Read More »

Scroll to Top