DevSecOps
Check your GitHub repos: A secret stealer hit tens of thousands of them
A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In…
GitHub Agentic Autofix and the question of who owns a bad AI patch
In this Help Net Security interview, Marcelo Oliveira, VP of Product Management at GitHub, talks about who is accountable when an AI-generated…
What a security leader should tell the CEO about leaked credentials
In this Help Net Security interview, Eric Fourrier, CEO of GitGuardian, talks about leaked credentials and personal liability for security leaders and…
Ghostunnel: Open-source TLS proxy with mutual authentication
Ghostunnel is an open-source proxy that handles TLS for programs that cannot handle it themselves. It works in two directions. In server…
Secure your containers without breaking what works
Container security has a familiar problem. Teams identify vulnerabilities, but turning those findings into lower risk is much harder. A standard container…
Witness: Open-source framework for verifying how your software was built
Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before…
Bearer CLI: Free, source-available code security scanning tool (SAST)
Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the…