puaro
6 posts on this topic. For the full archive, see the security blog. Comparison writes-ups live on Why Puaro and the methodology page.
Source Code Secret Leaks Cost $5.47 Million Per Incident: Here Is the Breakdown
When developers leave live API keys, AWS tokens, or database credentials in a repository, attackers do not need to break in: they log in. Industry estimates put the average cost of a single secret leak at $5.47 million in 2026. Here is where that money goes.
A Machine Broke Into the Cloud With No Human at the Keyboard
Security researchers at Unit 42 built a system called Zealot that broke into cloud infrastructure from start to finish without anyone typing a command. What it did, entirely on its own, should change how teams treat "low priority" findings.
Innovation or Negligence? The Dark Side of the "Vibe Coding" Wave
Security researchers at RedAccess scanned hundreds of thousands of apps built on vibe coding platforms like Lovable, Replit, and Base44. What they found should worry anyone shipping software without a security review.
Europe's New Software Security Law: What It Means for Your Team
The EU Cyber Resilience Act sets mandatory security rules for software and connected hardware sold in Europe. The first deadline hits in September 2026. Here is what it means in plain English and what you need to do before the clock runs out.
The New "Git Push": How Prompt Injection Became a Critical RCE Vector
CVE-2026-3854 proved that a single git push can compromise millions of repositories without touching a single line of application code. Combined with CVE-2025-53773 and EchoLeak, 2026 has made one thing clear: prompt injection is now a production-grade threat vector, not just a curiosity.
Half a Million Lines, One Public Package: Lessons from the Anthropic Claude Leak
News reports describe how a source map file inside a public npm package may have exposed over half a million lines of Claude Code CLI source. Here is a plain-English look at what went wrong and what actually needs checking before you publish.