What are Secrets Leaks in CI/CD Pipelines?
Almost every modern application is assembled by an automated pipeline, and that pipeline can’t do its job without credentials. The credentials might include a key to pull a private dependency, a token to push an image, and a password to run a migration. Credentials are leaked far more often than most teams realize. In 2024 […]
Slopsquatting: How AI-Hallucinated Packages Threaten the Software Supply Chain
Slopsquatting is a software supply chain attack where criminals register malicious packages under the fake names that AI coding assistants invent, then wait for developers to install them. Because AI tools routinely recommend libraries that do not exist, attackers can turn a confident chatbot suggestion into a direct path into your build. The risk grows […]