Original Post: How the OWASP Top 10 Vulnerabilities List Developed? | by Ajay Monga | Jul, 2024 The OWASP Top 10 is a crucial document for web application security, representing a consensus on the most… Read More »Evolution of Cybersecurity: An Insight into the Development of the OWASP Top 10 Vulnerabilities List
Original Post: Appsec Development: Keeping it all together at scale Summary: Appsec Development at Scale The article discusses the challenges and solutions in scaling application security (Appsec) within a rapidly growing startup, Snowflake. Initially, security… Read More »Mastering AppSec Development: Strategies for Scalable Security Solutions
Original Post: Guide to Cost-Effective Application Security The article provides insights into adopting free and open-source tools (FOSS) to enhance application security programs in organizations. Drawing from extensive experience in cybersecurity, the author notes that… Read More »Affordable Strategies for Enhancing Application Security: A Comprehensive Guide
Original Post: Should random() be banned? The content discusses whether developers should be alerted when non-cryptographically secure random() functions are used, a practice identified by tools like Bandit and gosec. Academics argue for flagging these… Read More »The Debate on Banning random(): Exploring Pros and Cons
Original Post: Broken Function Level Authorization — Web API Security Champion The content discusses a case study on the "Damn Vulnerable RESTaurant API," specifically focusing on a security vulnerability known as Broken Function Level Authorization. This vulnerability… Read More »Mastering Web API Security: Defeating Broken Function Level Authorization
Original Post: Jenkins Meetup We were invited to present at the Jenkins Online Meetup on February 10th. During the event, we showcased Semgrep, an open-source static analysis tool supporting over 12 languages, which simplifies creating… Read More »Highlights from the Latest Jenkins Meetup: Key Takeaways and Insights
Original Post: On Entrust? Imperva has your back! Managing SSL/TLS certificates is essential but demanding for organizations, ensuring secure web communications while requiring vigilant oversight. The complexity increases with recent industry changes, like Google’s upcoming… Read More »Entrust Concerns? Discover How Imperva Ensures Your Security!
Original Post: How we made Semgrep rules run on Semgrep rules Semgrep, a tool for finding security bugs and anti-patterns in code, now supports YAML. This enables the scanning of various configurations, including Kubernetes and… Read More »Meta-Analysis: Implementing Semgrep Rules to Optimize Semgrep Rule Creation
Original Post: Application Security Testing: Safeguarding Open-Source Software The article addresses the crucial role of open-source components in software development, emphasizing their contribution to faster and cost-effective app development cycles. Despite these benefits, open-source components… Read More »Enhancing Open-Source Software Protection through Application Security Testing
Original Post: Announcing C# alpha support Semgrep v0.52.0 has upgraded C# support from development to alpha, meaning it can now parse most C# code with a 97% accuracy rate and supports matching metavariables and ellipses… Read More »Exciting News: C# Alpha Support Now Available!