Articles

Cloud Compliance Explained

What is cloud compliance, and how do you bring your cloud environment into compliance with different standards and controls whilst following best practices?

Guide to Software Composition Analysis: 5 key challenges of SCA

The code driving many—in fact, most—applications today includes open source components.

What is ASPM? (Application Security Posture Management)

Application security posture management (ASPM) overview - Learn how to strengthen app security using holistic visibility, automation & robust security measures.

The Importance of Policy as Code in Your Compliance Strategy 

Learn why compliance as code should become a key part of your overall security strategy, enabling security at scale based on automated Policy as Code rules.

OpenCart Vulnerability Research (v4.0.2.3/3.0.3.9)

Discover the security vulnerabilities in OpenCart's admin and customer functionalities, including XSS, Zip Slip, and SQL Injection exploits. Learn how these flaws impact e-commerce systems and how attackers can exploit them for remote code execution.

How to prevent prototype pollution vulnerabilities in JavaScript

Safeguard your JavaScript applications from prototype pollution vulnerabilities. Learn how to prevent attackers from infiltrating object prototypes with malicious code, jeopardizing your data and application security. Read about effective strategies, leverage Snyk's potent tools, and shield your JavaScript projects from this critical threat.

Getting started with JavaScript static analysis

Static analysis tools are a must-have for JavaScript developers. They automatically scan your code for errors, security vulnerabilities, and formatting issues. This helps you write better code faster and improve your overall development process.

Proxmox VE CVE-2024-21545 - Tricking the API into giving you the keys

Read about a critical vulnerability (CVE-2024-21545) in Proxmox VE that allows attackers to gain full control of the system. By exploiting a flaw in the API handling, attackers with limited permissions can steal sensitive files and forge session tokens for a complete system takeover.

How Snyk Helps with the OWASP Software Assurance Maturity Model

Read how the OWASP Software Assurance Maturity Model (SAMM) and Snyk can work together to provide an effective approach to measuring, managing, and improving your software security. Learn about the key benefits, practical implementation steps, and the specific tools offered by Snyk to support your organization's security journey.

Oops I built a feature and created an Open Redirect Vulnerability in a Deno app

Build your first Deno web application with a step-by-step guide. Learn how to implement a redirect feature while avoiding common security pitfalls like open redirect vulnerabilities. Secure your Deno app with best practices and discover how to set up a Deno development environment in GitHub Codespaces.

JavaScript Static Analysis with ESLint and Biome

Biome, a new tool in the JavaScript ecosystem, combines code formatting and quality linting. It offers speed and performance advantages over traditional tools like ESLint and Prettier, making it a compelling alternative. With its integration into development environments like VS Code and potential adoption by major projects, Biome is poised to reshape the way JavaScript developers approach code quality and formatting.

Getting started with Practical Rego

Read this guide introducing Rego, a declarative policy language, for programmers familiar with imperative languages like Python or Java. It covers key concepts, common pitfalls, and best practices for writing effective Rego policies.

Improving your Java application with Records

Java Records revolutionizes the way you create data-centric classes in Java, offering a concise and secure approach. Embrace Java Records and unlock efficient and maintainable Java development.

How does Snyk DCAIF Work under the hood?

Read our technical deep-dive into how Snyk's DCAIF works. To start, with Snyk's Deep Code AI Fix, simply register for a Snyk account here, enable DeepCode AI Fix in your Snyk settings, and start reliably auto-fixing vulnerabilities in seconds.

How to respond to a newly discovered vulnerability

Learn how to effectively respond to newly discovered vulnerabilities with a structured approach using the Vulnerability Management Cycle. Discover the importance of tools like Snyk for centralizing, analyzing, and remediating vulnerabilities across your software development lifecycle.

Hijacking OAUTH flows via Cookie Tossing

Learn about Cookie Tossing attacks, a rarely explored technique to hijack OAuth flows and enable account takeovers at Identity Providers (IdPs). Discover its implications, real-world examples, and how to safeguard applications using the Host cookie prefix.

Vulnerabilities in Deep Learning File Formats

While pickle is a common way to store neural network weights, it can be vulnerable to attacks if downloaded from untrusted sources. Safer alternatives like SafeTensors only store raw data and prevent malicious code execution.

Python Pickle Poisoning and Backdooring Pth Files

Discover the security risks of Python's pickle module and learn how malicious code can exploit PyTorch .pth files. Explore practical examples, safeguards like safetensors, and tips for secure machine learning workflows.

How to avoid SSRF vulnerability in Go applications

In this article, learn how SSRF vulnerabilities manifest in Go applications, and how developers can implement effective security measures to protect their applications and data.

Remote Code Execution with Spring Boot 3.4.0 Properties

this article introduces two methods for leveraging Logback configuration to achieve Remote Code Execution (RCE) in Spring Boot applications. These techniques are effective on the latest version of Spring Boot, with the second approach requiring no additional dependencies.