Supplychain

👋 Sign in for the ability to sort posts by relevant, latest, or top.

Edison Flores

Oct 3

Three merged PRs in an MCP security scanner: the review that found my bug, and two more

#mcp #security #supplychain #python

4 min read

kozhevniko

Oct 3

Container Image Provenance: Signing Is Half the Control

#security #containers #supplychain

2 min read

NTCTech

Oct 2

Rotating Credentials Is Not Revoking Them. The Revocation Unit Decides Whether You Can.

#security #devops #architecture #supplychain

8 min read

kozhevniko

Oct 1

Two Flaws, One Chain: How JFrog Artifactory Was Pushed to Admin

#security #jfrog #artifactory #supplychain

4 min read

OnaEiuspkz

Oct 1

CVE-2026-60004: code injection through the Gitea diffpatch API, and why a forge holds everything

#gitea #supplychain #codeinjection

2 min read

DevOps Daily

Oct 1

GitHub Actions Removed Node 20. Find Every node20 Action You Still Run

#cicd #githubactions #node #supplychain

14 min read

jeffrey

Oct 1

Browser extensions are an enterprise control problem, not a user hygiene problem

#browsersecurity #extensionmanagement #enterprisepolicy #supplychain

4 min read

StarkMan

Sep 30

When the Artifact Repository Is the Target: JFrog Artifactory and the Software Supply Chain Chokepoint

#security #supplychain #vulnerabilitymanagement

3 min read

OnaEiuspkz

Oct 1

GitHub Actions Supply Chain Risk: Pinning, OIDC and Least-Privilege Tokens

#supplychain #cicd #githubactions

2 min read

yutianle

Sep 30

Brevo: A Cloudflare Worker That Rewrote a Marketing Platform in Flight

#supplychain #cdn #wordpress #clickfix

2 min read

Anton Golub

Sep 29

yarn.lock: may the `--force` be with you

#javascript #security #npm #supplychain

14 min read

Anton Golub

Sep 29

yarn.lock: you can't `sed` a graph

#javascript #npm #supplychain #security

10 min read

Anton Golub

Sep 29

yarn audit [still does not] fix

#javascript #security #tools #supplychain

9 min read

StarkMan

Sep 28

Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out

#security #zoomeye #exposure #supplychain

3 min read

jeffrey

Sep 25

Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline

#security #supplychain #incidentresponse #artifactory

3 min read

👋 Sign in for the ability to sort posts by relevant, latest, or top.