Expert perspectives on application security, compliance, and emerging threats
StandardsThe Problem: Data Leakage in Federated Learning Your federated learning models might be leaking training data. Research by Carlini et al. shows that sensitive information, like social security numbers
IncidentWhat Happened Truffle Security discovered nearly 3,000 Google Cloud API keys embedded in publicly accessible client-side code. These keys provided unauthorized access to Google s Gemini API endpoints,
StandardsScope - What This Guide Covers This guide explains how to prepare your security program for NIST s forthcoming AI-specific control overlays, building on NIST SP 800-53 Rev 5 and the NIST Cybersecurity
GuidesThe EU Cyber Resilience Act (CRA) is now a concrete reality. Your organization needs clear processes to translate these regulatory obligations into actionable engineering tasks. This template provides
Get weekly security insights and compliance updates delivered to your inbox.
StandardsScope - What This Guide Covers This guide explores how the 2025 OWASP Top 10 update impacts your security engineering practices when using AI coding assistants, deploying AI-powered features, or integ
GeneralThe myths around federal software supply chain security persist because they re comfortable. They let you treat authorization as a one-time event, vulnerabilities as a scoring exercise, and compliance
ResearchYour organization now requires a Software Bill of Materials (SBOM) for every release, and your CI/CD pipeline generates them automatically. However, a recent study of 25,882 Java SBOMs revealed that 7
StandardsThe Challenge A consortium of financial institutions participating in the UK-US PETs Prize Challenges faced a significant issue: how to train a shared fraud detection model across vertically partition
GuidesYour open source project finally earned the OpenSSF Baseline Badge. You added it to your README, announced it on social media, and moved on. Three months later, a critical vulnerability in your depend
StandardsNIST is establishing a dedicated program for AI cybersecurity and privacy. For your compliance team, this raises a critical question: should you adopt the AI Risk Management Framework now, or continue
ResearchThe Challenge The European Union s draft of the Cyber Resilience Act (CRA) initially treated open source software like commercial products, imposing liability on community maintainers—volunteers often
IncidentWhat Happened A threat actor compromised the Cline CLI package on npm and modified it to silently install OpenClaw—an AI coding agent—on developer machines without consent. The malicious version was l
StandardsThe Challenge Your compliance team faces a recurring problem: Python developers move fast, while security teams move carefully, creating a risk gap. When uv emerged as a high-performance Python packag
GuidesWhy This Matters Your application needs to integrate with third-party services like Google Workspace, Salesforce, and GitHub without collecting and storing user passwords. You ve heard just use OAuth,
GeneralYour developers are shipping code faster than ever, thanks to AI coding assistants. However, if you re still using the same security tools from three years ago, you re accumulating risk faster than yo
StandardsWhat Changed GitHub s Secure Open Source Fund (SOSF) has added two Software Bill of Materials (SBOM) generators to its portfolio: cdxgen and CycloneDX .NET. These projects now receive funding, securit
