Supply Chain Security, in plain English.

Log4j One Year Later: What We Learned and What We Didn't Fix

A year after Log4Shell shook the internet, many organizations still had vulnerable instances. Here's what the anniversary revealed about our industry.

GitHub Repository Security Settings Guide

Configure GitHub repository security settings for branch protection, secret scanning, dependency alerts, and code scanning.

Cilium Network Security in Kubernetes: Beyond Basic Network Policies

Cilium uses eBPF to provide network security that standard Kubernetes NetworkPolicies cannot match. Here is what it adds and how to configure it.

FortiGate SSL-VPN Zero-Day (CVE-2022-42475): How a Heap Overflow Gave Attackers the Keys

A heap-based buffer overflow in Fortinet's SSL-VPN was actively exploited before disclosure. State-sponsored actors used it to deploy custom implants on critical infrastructure.

The End-of-Year Dependency Audit Ritual

Most dependency audits get done in a panic after a CVE lands. A planned year-end audit is cheaper, more thorough, and produces a backlog you can actually work through in Q1.

Startup Security at Series A: Scaling Without Breaking

You have raised Series A, hired 20 engineers, and landed your first enterprise customers. Your seed-stage security shortcuts are starting to crack. Here is how to scale security alongside your product.

Cargo Build Script Security: What build.rs Can Do to Your Machine

Rust build scripts run arbitrary code during compilation. Here is what they can access and how to evaluate the risk in your dependency tree.

Kubernetes Pod Security Standards: From PodSecurityPolicy to the New Admission Controller

PodSecurityPolicy is dead. Pod Security Standards replaced it. Here is what changed, what the three levels mean, and how to migrate without breaking your clusters.

Griffin AI vs Cohere Command for SecOps