AYAayush Yadavinaayushyadav.hashnode.dev·19h ago · 26 min readWhere the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT PipelineEvery VAPT report ends the same way: a handful of numbers. A CVSS score. A severity label. A priority rank. Sometimes an aggregate risk score. Those are the numbers a remediation team actually acts on10
JSjagmohan singhinjagsingh-security.hashnode.dev·2d ago · 8 min readOut-of-the-Box, Out of Touch: Why Vendor Detections Don't Know Your Threat ModelSix months into rolling out SAST, SCA, and SBOM generation, a team can look at their dashboard and see "100% of repositories onboarded." Nobody's worried — coverage looks complete. Dig one layer down 00
MSManu Shuklainecorpit.hashnode.dev·2d ago · 15 min readGitHub shipped a Mitigated dismissal reason on 20 August 2026 that its own REST API cannot setGitHub shipped a Mitigated dismissal reason on 20 August 2026 that its own REST API cannot set Summary. GitHub published three application-security changelog entries on 20 August 2026: a new Mitigated00
ZZennoxainzennoxa.hashnode.dev·2d ago · 4 min readThere are 755 static-analysis tools. Only 42 are open-source security scanners.If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosystem's size suggests. W00
IAInioluwa Adeyemoininioluwa2003.hashnode.dev·2d ago · 3 min readDay 0Earlier this week, I decided I would be spending the next 90 days building toward DevSecOps and documenting the whole thing here, in public, as it happens. Why DevSecOps? My experience in penetration 00
MSManu Shuklainecorpit.hashnode.dev·2d ago · 13 min readGitLab 19.3 made credit usage caps GA on 20 August 2026 - a cap of 0 still spendsGitLab 19.3 made credit usage caps GA on 20 August 2026 - a cap of 0 still spends Summary. GitLab published its 19.3 release notes on 20 August 2026 and made GitLab Credits usage caps generally availa00
PMPaul MKinpaulappsec.hashnode.dev·5d ago · 7 min readI wrote four Semgrep rules and never ran them. Two were broken.I have a line I use a lot: a finding is a snapshot, a rule is a ratchet. Find a bug once and you've closed one instance. Write the rule and you've closed the class, including in code nobody will ever 00
JTJAY TANKinjaytank.hashnode.dev·6d ago · 8 min readYour `terraform.tfstate` is a plaintext password fileThere is a file in almost every Terraform repository that quietly holds your database password, your API keys, and your TLS private key - in cleartext. It is not a mistake anyone made. It is how Terra00
TATanweer Ahmedincloudwithtanweer.hashnode.dev·Aug 15 · 10 min read10 AWS IAM Mistakes That Still Put Cloud Environments at Risk☁️ Cloud with Tanweer Future of Cloud Series • Episode #4 ⸻ Introduction AWS gives us hundreds of services. But one service quietly sits at the center of almost everything: Identity and Access Managem00
BKBrian Kinginsolodev.app·Aug 15 · 19 min readDev Teams and their Docs.Abstract. Project documentation serves as the single source of truth, ensuring that all team members and stakeholders are aligned throughout the Project Lifecycle. This post covers the Software Develo00
