Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Snyk Code CLI support now in public beta

Snyk is on the mission to make Static Application Security Testing (SAST) tools work for developers throughout the DevOps pipeline. Snyk Code scans in real time with high accuracy — and it does it right from the tools and workflows developers are already using. For example, the IDE plugins for IntelliJ, PyCharm, WebStorm, and Visual Studio Code make it easy to code, scan and fix even before code hits the version management.

The Tokenised Auth

Authentication can sound simple. It's just a login form and a couple of database columns, right? Why would you need a separate identity platform to solve this? You've probably heard that you shouldn't roll your own crypto, or payments. Well, add authentication to that list. Ben Dechrai joins us to discuss the aspects of good authentication, from tokenisation to multi-factor, and dives into a few features of Auth0 that help you customise, extend, and personalise your users' experience.

Anatomy of a Cloud Infrastructure Attack via a Pull Request

In April 2021, I discovered an attack vector that could allow a malicious Pull Request to a Github repository to gain access to our production environment. Open source companies like us, or anyone else who accepts external contributions, are especially vulnerable to this. For the eager, the attack works by pivoting from a Kubernetes worker pod to the node itself, and from there exfiltrating credentials from the CI/CD system.