supply-chain
4 posts on this topic. For the full archive, see the security blog. Comparison writes-ups live on Why Puaro and the methodology page.
Innovation or Negligence? The Dark Side of the "Vibe Coding" Wave
Security researchers at RedAccess scanned hundreds of thousands of apps built on vibe coding platforms like Lovable, Replit, and Base44. What they found should worry anyone shipping software without a security review.
Half a Million Lines, One Public Package: Lessons from the Anthropic Claude Leak
News reports describe how a source map file inside a public npm package may have exposed over half a million lines of Claude Code CLI source. Here is a plain-English look at what went wrong and what actually needs checking before you publish.
How AI-Powered Scanning Prevents the Next 'GlassWorm' Supply Chain Attack
The recent GlassWorm incident exposed critical vulnerabilities in the software supply chain when developers accidentally leaked VS Code extension tokens. Learn how AI-powered scanning provides proactive prevention beyond simple pattern matching.
The GhostAction Attack: How 3,300+ Secrets Were Stolen from GitHub Repositories
A large-scale campaign abused GitHub Actions to exfiltrate 3,325 secrets from 817 repositories and 327 users. Learn how it worked and how to secure CI/CD pipelines.