Tag

Developer Security

13 articles

Latest in Developer Security

Noma Security Discloses Claude Code Desktop Exploit

Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypass sandbox protections and silently steal sensitiv…

Oct 14, 20263 min

All Developer Security Articles

Showing 1–13 of 13

Sep24

Blogs

GitHub Gives Enterprises a Full Count of Who Holds the Keys

GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps…

3 min

Sep23

Cycode Extends DevSecOps Reach to Software Packages Developers Download

Cycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages.

3 min

Sep23

Blogs

Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters

ZCode’s default-on indexing feature reportedly uploaded entire developer workspaces to cloud storage, highlighting why AI coding assistants should be treated as privileged software…

3 min

Sep23

Blogs

Why Shift Left is Dead

AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire develo…

3 min

Sep21

Blogs

Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent

Two patched OpenAI Codex vulnerabilities, Heapjack and Overpatch, exposed how coding agents can escape sandboxes and reach developer systems without approval prompts.

3 min

Sep11

Blogs

GitHub Widens the Door on Advanced Security Trials

GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.

3 min

Sep09

Blogs

GitHub Puts Guardrails on Copilot’s Sandbox Inside JetBrains IDEs

JetBrains IDEs are where a lot of enterprise backend work happens — Java, Kotlin, Spring, big monorepos with a lot to break. So when an AI coding agent starts running shell command…

3 min

Aug19

Blogs

Are LLMs Equally Good (or Bad) at Building Secure Software?

An SCW study finds a large variance in how frontier and budget LLMs perform across different frameworks, and explains the striking cost variance.

3 min

Jul22

Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma…

3 min

Jul13

Blogs

Why Developer Workstations Have Become a Critical Part of the Software Supply Chain

For years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest tha…

3 min

Jun30

Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents

A clean GitHub repository that contains no malicious code can launch an attack and fully compromise a developer’s systems by using indirect prompt injections to trick AI-powered co…

3 min

Jun12

Blogs

Shift Left to the Developer’s Machine: Building Local Git Security Gates

Shift left to the developer’s machine. The principle is what matters: Stop secrets before they ship. The tooling is a means to that end.

3 min