An attacker who can open a PR can silently swap a package hash in package-lock.json and have it merged by a reviewer who never looks at lockfiles. This article explains the attack, real-world cases, and the controls that prevent it.
A practical guide to the security tools solo developers actually use in 2026, covering secrets scanning, dependency auditing, static analysis, and repo health checks, with honest takes on what's worth your time.
Most LLM-generated Dockerfiles run as root, pull mutable tags, and bake secrets into layers. This article covers the six most damaging mistakes and the one-line fixes for each.
API keys, database passwords, and JWT signing secrets committed directly to source code are the single most frequent security issue in AI-assisted projects. This article explains why it happens and how to fix it systematically.
LLMs frequently produce query builders that concatenate user input directly into SQL strings, bypassing the parameterisation that ORMs exist to provide. This article walks through the most common patterns and how to spot them in a code review.