ci-cd
4 posts on this topic. For the full archive, see the security blog. Comparison writes-ups live on Why Puaro and the methodology page.
The New "Git Push": How Prompt Injection Became a Critical RCE Vector
CVE-2026-3854 proved that a single git push can compromise millions of repositories without touching a single line of application code. Combined with CVE-2025-53773 and EchoLeak, 2026 has made one thing clear: prompt injection is now a production-grade threat vector, not just a curiosity.
Half a Million Lines, One Public Package: Lessons from the Anthropic Claude Leak
News reports describe how a source map file inside a public npm package may have exposed over half a million lines of Claude Code CLI source. Here is a plain-English look at what went wrong and what actually needs checking before you publish.
Puaro vs Gitleaks vs TruffleHog: Which Secret Scanner Fits Your Workflow?
A practical comparison of three secret scanning tools (regex speed, deep verification, and AI-powered classification) to help you choose the right fit for your team.
The GhostAction Attack: How 3,300+ Secrets Were Stolen from GitHub Repositories
A large-scale campaign abused GitHub Actions to exfiltrate 3,325 secrets from 817 repositories and 327 users. Learn how it worked and how to secure CI/CD pipelines.