Blog/Codebase Security
Exposed secrets, vulnerable dependencies, and the supply-chain attacks that reach you through packages you did not write. Incident analysis and practical remediation, in business terms.
10 articles
A poisoned release of jscrambler, itself a security vendor, ran an infostealer on install. Here's the founder's lesson on what npm packages do to your machine.
In late May 2026, attackers used 33 malicious npm packages not to steal — but to map which companies use which internal tools. Here's the founder's risk.
A breach at vendor Klue exposed Salesforce data at nine-plus companies via stolen OAuth tokens. Here's the founder's lesson on third-party integration risk.
On June 17, 2026, attackers backdoored 140+ Mastra AI-framework npm packages in 88 minutes. Here's the business lesson for founders shipping on AI tooling.
A compromised OAuth app at one vendor cascaded into Vercel and exposed customer environment variables. Here's what founders should learn from the 2026 breach.
Worms hit TanStack, Mistral AI, Red Hat and 170+ npm/PyPI packages in May-June 2026. Here's the business risk and a founder's response checklist.
A single endpoint that didn't check credentials let anyone pull ServiceNow customer data. Here's what founders should learn from the June 2026 exposure.
69% of security leaders say AI adoption is outpacing their compliance controls. New research reveals AI has become the top audit risk for 2026—here's what that means for your organization.
A Python package used by AI tools everywhere was poisoned for two hours. Here's what happened, how attackers chained compromises together, and what you should do now.
API keys, database credentials, and tokens hiding in your codebase are ticking time bombs. Learn how to scan for exposed secrets before attackers find them first.