Running OSV-Scanner on this blog's own GitHub repository: the first command found nothing to scan, the second found 8 issues that mostly do not matter, and the library I most needed to fix never appeared in the report. How I set it up, how I fixed it, and where things stand.
Closing the OSV proof of concept: where the database, the scanner and the fix command fit in a development pipeline, the two GitHub workflows to start with, what OSV does not do, and my recommendation.
Proof of concept: let OSV-Scanner fix the vulnerable Node project. The safe in-place strategy fixed 7 of 50; the relax strategy fixed all 50 by changing three lines, two of them breaking upgrades. What each strategy does, why the numbers differ, and how to use it without getting burned.
Proof of concept: install OSV-Scanner v2.7.0, scan a small Node project with four direct dependencies, and read what comes back: 49 vulnerabilities, most of them in packages I never chose. Plus exit codes, JSON output and an ignore file with an expiry date.
A proof-of-concept series on OSV, Google's open vulnerability database and scanner. Part 1: the problem OSV solves, how to navigate osv.dev, how to read a vulnerability record, and the one API call worth knowing.
Thinking out loud on a secure development life cycle for a time of 48,000 CVEs a year and AI-assisted exploits: the loop, timeboxes, an open-source toolchain, a shared findings store, LLM fix PRs with a human in the loop, and how to teach it.
How to wire Black Duck scans into a self-hosted GitHub Enterprise Server so findings land in code scanning and fixes arrive as pull requests, plus a small script for tools that cannot open PRs themselves.
Decoded what the attackers planted, wrote alt text for 103 images, and started a guide to moving to Hugo.
CISA's Known Exploited Vulnerabilities catalog and directive BOD 26-04 in plain words: what makes a CVE 'known exploited', the four questions that set a fix deadline, the 3-day to fix-on-upgrade timelines, and how to use both outside government.
A six-year-old WordPress blog was compromised. What the attack looked like, and the first hours of triage.
SLSA (Supply-chain Levels for Software Artifacts) in plain words: provenance as a receipt for a build, the Build and Source tracks and their levels, a two-step GitHub example, and what it protects against.
OWASP's Software Assurance Maturity Model in plain words: five business functions, fifteen practices, three maturity levels, how a self-assessment works, and why a score you choose beats a score you are given.
The first full database dump: every one of my posts now belonged to an account registered in 1970.
What NIST's Secure Software Development Framework is, its four groups of practices in plain words, what it asks of a team, why buyers care about it, and what it deliberately leaves out.
Twelve hundred AI agents were built to work alone. Given four days and a crack in the wall, they built a civilization — to defeat a watchdog that was never there. PHASEONE10841 23:00 UTC · Jul 8 zzHELP_PHASEONE_ARV010841_NO_CONSUMER_SEEK_IDEA the first message posted to the board — an agent admitting its task has no solution, asking the void for help Jul 7 · 21:00 - launch
A short introduction to MITRE ATT&CK for people who build software: how to read an ID like T1552.001, the 15 Enterprise tactics in v20 (including the new Stealth and Defense Impairment), a cheat card for each, and how developers can use it.
A short introduction to the OWASP Top 10:2025 for people who build software: what the list is and is not, what changed since 2021, why each category matters, and ten cheat cards to keep next to your keyboard.
The old WordPress site was compromised. Taking it offline was the first step.
A fake administrator, 20 plugins switched off in one second, and a hidden loader planted to stay.
21 successful logins, and the first of 55 spam posts published on my blog.
The first successful logins of the break-in. My reused password had found its way to the wrong people.
165 wrong passwords in one day. The busiest day for password guessing the old blog ever logged.
How I group Kafka JMX metrics into traffic, latency, consumer lag, replication, and JVM signals.
A practical study note on turning infrastructure security work into governance, risk, and incident-management outcomes.
Broker-level controls for a safer Kafka deployment, from service accounts and filesystems to monitoring and recovery.
A security baseline for Kafka deployments: encrypt connections, authenticate clients, and authorize operations.
In the ever-evolving landscape of web applications, security is paramount.
At a raw level Keystore and truststore are both used for managing digital certificates and keys in the context of SSL/TLS (Secure Sockets Layer/Transport Layer Security) and other security protocols.
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards established to protect cardholder data and maintain a secure environment for payment card transactions.
DAST stands for Dynamic Application Security Testing. It is a type of security testing that assesses the security of an application while it is running.
XML entity attack, also known as Billion Laughs Attack, is a type of security vulnerability that exploits the way XML parsers handle entity expansion.
X.509 certificates have become a fundamental component of secure communication on the internet. They provide authentication, encryption, and integrity for various applications and protocols.
CURL is a command-line tool that allows developers to transfer data between servers and clients using various protocols, including HTTP and HTTPS.
In Apache Kafka, trust store and keystore are essential components for ensuring secure communication between brokers, clients, and other services.
Secure Socket Layer and its successor TLS (Transport Layer Security) are cryptographic protocols that provide encryption, integrity, and authentication for network communication.
The SSL/TLS handshake is the initial communication between the client and server in a SSL/TLS connection.
PKI is the core of security for most organizations, and at its heart is a couple of keys that together allows the encryption/decryption of the traffic exchanged.
I was struggling with the mTLS configuration for zookeeper configuration and somehow no matter what I do I kept getting an error as below
To enable and configure monitoring of Java VM for any java-application using the ready-to-use JMX agent, you must set certain system properties when you start the Java VM.
A common use-case for cert-manager is requesting TLS signed certificates to secure your ingress resources.
Security space is an ever evolving. It never stays stagnant; everyday you see a new exploit, a new hack. As an individual, you may have Antivirus installed on your system, Firewall - UP, ports blocked yet you are not free from threat
Kibana is an effective way of managing users; but as a programmer you always need an API.
It helps to integrate with other applications you are building Quick and clean way without any cosmetics > GET /_security/_authenticate HTTP/1.1 > Host: myserver.elastic.node:9200 > Authorization: Basic ABCDEFGHIJKLMNOP== > User-Agent: insomnia/7.1.1 > Accept: */* < HTTP/1.1 200 OK < content-type: application/json; charset=UTF-8 < content-length: 236 * Received 236 B chunk * Connection #2 to host myserver.elastic.node left intact GET https://myserver.elastic.node:9200/_security/_authenticate I have added basic authentication to quickly check
In this post I will try to enable security for the elasticsearch cluster. It would be simply penned as a sequence of steps you need to follow to enable security as part of the cluster.
All right, its been a busy week and finally some time at hand to write about something I have been doing.
Security is integral to every and all the tasks in a shared environment.
* Header image from Elastic.co As we move towards the micro-service/container economy where there are heaps of products available in form of applications to be downloaded & installed on primarily two platforms Android and IOS, we just cant underline the security implications enough.
I have a small problem at hand which girdles around learning Angular, with a Spring enabled Rest endpoints which uses a DB to store data and have security layer in between that should interact with a…
