6h ago · 7 min read · If your company uses containers, you know that keeping them safe is a never-ending job. And let's be honest, it is usually a job that ends up breaking your automated systems at 4:45 PM on a Friday. Wh
Join discussion
2h ago · 7 min read · Agent Tooling Supply Chain Security: OWASP Agentic Top 10 and the pentagi Threat Model Two things happened in the same week. Trivy, the most popular container vulnerability scanner, got its GitHub Actions workflow compromised through a supply chain a...
Join discussion3h ago · 2 min read · We paused feature development to fix foundations. An implementation audit found four critical gaps between our specification and our code. v0.5.5 closes all four. Gap 1: CLI Bypassed the WASM Sandbox rotifer test and rotifer agent run called import()...
Join discussion
6h ago · 6 min read · We've shipped 14+ products at Gerus-lab. Web3 platforms on TON and Solana, AI-powered SaaS tools, GameFi backends handling thousands of concurrent users. And in 2025, like everyone else, we got excited about AI-assisted coding. Then we watched a clie...
Join discussion6h ago · 11 min read · Samsung allowed its semiconductor engineers to use ChatGPT in March 2023. Within 20 days, three separate employees had fed proprietary source code, chip yield data, and confidential meeting transcript
Join discussion
7h ago · 4 min read · The aquasecurity/trivy ecosystem got hit this week. Supply chain compromise - a tool that 50,000+ organizations rely on for vulnerability scanning had its own supply chain briefly weaponized. The irony isn't lost on anyone. 65 points on Hacker News, ...
Join discussion8h ago · 7 min read · Smart contract auditing has a dirty secret: most auditors spend 60–70% of their time on mechanical checks that a static analyzer could handle in seconds. The remaining 30–40% — where the real bugs hide — gets compressed into whatever time is left bef...
Join discussion13h ago · 4 min read · A single, well-crafted prompt can bring down even the most advanced language model-based agent, as evidenced by the recent case where a popular chatbot was tricked into revealing sensitive user information with just five carefully designed interactio...
Join discussion22h ago · 3 min read · Microsoft Azure Monitor alerts are being abused to send callback phishing emails that impersonate warnings from the Microsoft Security Team about unauthorized charges on your account. Azure Monitor is Microsoft's cloud-based monitoring service that c...
Join discussion
