Blog

Featured Blogs

 
Legit Security | How to Get the Most From Your Secrets Scanning. Secret scanning is essential for unlocking next-level software supply chain security. Get tips & best practices for optimal secret scanning to secure your code.
AppSec

How to Get the Most From Your Secrets Scanning

March 25, 2024

How to Get the Most From Your Secrets Scanning. Secret scanning is essential for unlocking next-level software supply chain security. Get tips & best practices for optimal secret scanning to secure your code.

Read More
Legit Security | Microsoft Under Attack by Russian Cyberattackers. Understand how these attackers are operating and what their tactics mean for security strategies.
AppSec

Microsoft Under Attack by Russian Cyberattackers

March 15, 2024

Microsoft Under Attack by Russian Cyberattackers. Understand how these attackers are operating and what their tactics mean for security strategies.

Read More
Legit Security | Don't Miss These Emerging Trends in Cloud Application Security. Get details on trends and best practices in cloud application security.
AppSec

Don't Miss These Emerging Trends in Cloud Application Security

March 13, 2024

Don't Miss These Emerging Trends in Cloud Application Security. Get details on trends and best practices in cloud application security.

Read More
Legit Security | Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is reducing secret-scanning false positives..  
AppSec

Using AI to Reduce False Positives in Secrets Scanners

March 11, 2024

Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is reducing secret-scanning false positives..  

Read More
Legit Security | Understanding the White House Report on Secure and Measurable Software. Get details on the report, how to address it, and how Legit can help.  
AppSec

Understanding the White House Report on Secure and Measurable Software

March 08, 2024

Understanding the White House Report on Secure and Measurable Software. Get details on the report, how to address it, and how Legit can help.  

Read More
Legit Security | How to Get the Most From Your Secrets Scanning. Secret scanning is essential for unlocking next-level software supply chain security. Get tips & best practices for optimal secret scanning to secure your code.

How to Get the Most From Your Secrets Scanning

March 25, 2024

How to Get the Most From Your Secrets Scanning. Secret scanning is essential for unlocking next-level software supply chain security. Get tips & best practices for optimal secret scanning to secure your code.

Read More
Legit Security | Microsoft Under Attack by Russian Cyberattackers. Understand how these attackers are operating and what their tactics mean for security strategies.

Microsoft Under Attack by Russian Cyberattackers

March 15, 2024

Microsoft Under Attack by Russian Cyberattackers. Understand how these attackers are operating and what their tactics mean for security strategies.

Read More
Legit Security | Don't Miss These Emerging Trends in Cloud Application Security. Get details on trends and best practices in cloud application security.

Don't Miss These Emerging Trends in Cloud Application Security

March 13, 2024

Don't Miss These Emerging Trends in Cloud Application Security. Get details on trends and best practices in cloud application security.

Read More
Legit Security | Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is reducing secret-scanning false positives..  

Using AI to Reduce False Positives in Secrets Scanners

March 11, 2024

Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is reducing secret-scanning false positives..  

Read More
Legit Security | Understanding the White House Report on Secure and Measurable Software. Get details on the report, how to address it, and how Legit can help.  

Understanding the White House Report on Secure and Measurable Software

March 08, 2024

Understanding the White House Report on Secure and Measurable Software. Get details on the report, how to address it, and how Legit can help.  

Read More
Legit Security | How to Address CISA Attestation. Get details on the CISA Attestation, how to address it, and how Legit can help.  

How to Address CISA Attestation

February 22, 2024

How to Address CISA Attestation. Get details on the CISA Attestation, how to address it, and how Legit can help.  

Read More
Legit Security | What to Look for in a Secrets Scanner. Find out the key capabilities of secrets scanners and what to consider when searching for a solution. 

What to Look for in a Secrets Scanner

February 21, 2024

What to Look for in a Secrets Scanner. Find out the key capabilities of secrets scanners and what to consider when searching for a solution. 

Read More
Gain insights into GenAI applications and how they represent an innovative category of technology, leveraging Large Language Models (LLMs) at their core.

GenAI-Based Application Security 101

February 13, 2024

Gain insights into GenAI applications and how they represent an innovative category of technology, leveraging Large Language Models (LLMs) at their core.

Read More
Gain insights in the latest changes in PCI DSS version 4 with this quick overview, highlighting the primary changes and how to best prepare for them.

Navigating the Shift: Unveiling the changes in PCI DSS version 4

February 07, 2024

Gain insights in the latest changes in PCI DSS version 4 with this quick overview, highlighting the primary changes and how to best prepare for them.

Read More
Gain insights into the 2024 Gartner's® report Emerging Tech Impact Radar: Cloud-Native Platforms report and how Legit Security was named a sample vendor.

Legit Security Named in the 2024 Gartner® Emerging Tech Impact Radar: Cloud-Native Platforms report

February 06, 2024

Gain insights into the 2024 Gartner's® report Emerging Tech Impact Radar: Cloud-Native Platforms report and how Legit Security was named a sample vendor.

Read More
The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious code and access secrets.

Azure Devops Zero-Click CI/CD Vulnerability

January 31, 2024

The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious code and access secrets.

Read More
Gain insights into Gartner's® new report and learn how to mitigate enterprise software supply chain risks

Mitigate Enterprise Software Supply Chain Security Risks - Insights Into the Gartner® Report

January 29, 2024

Gain insights into Gartner's® new report and learn how to mitigate enterprise software supply chain risks

Read More
Legit Security | In this blog series, we uncover the challenges of adopting SLSA provenance and discuss methods for overcoming those challenges.

SLSA Provenance Blog Series, Part 4: Implementation Challenges for SLSA Provenance for Enterprises

January 24, 2024

In this blog series, we uncover the challenges of adopting SLSA provenance and discuss methods for overcoming those challenges.

Read More
Learn how vulnerable self-hosted runners can lead to severe software supply chain attacks.

GitHub, PyTorch and More Organizations Found Vulnerable to Self-Hosted Runner Attacks

January 18, 2024

Learn how vulnerable self-hosted runners can lead to severe software supply chain attacks.

Read More
Legit Security | Your security is only as good as your team, so why leave it to chance? Learn how automated DevSecOps tools can radically boost your AppSec.

It's Time to Automate Your Security Testing w/ DevSecOps Tools

January 10, 2024

Your security is only as good as your team, so why leave it to chance? Learn how automated DevSecOps tools can radically boost your AppSec.

Read More
Legit Security | Reflections on a Legit 2023 and why we're excited as we look ahead to the new year.

Looking back on a Legit 2023

January 10, 2024

Reflections on a Legit 2023 and why we're excited as we look ahead to the new year.

Read More
Legit Security | In this blog series, we uncover the challenges of adopting SLSA provenance and discuss methods for overcoming those challenges.

SLSA Provenance Blog Series, Part 3: The Challenges of Adopting SLSA Provenance

December 28, 2023

In this blog series, we uncover the challenges of adopting SLSA provenance and discuss methods for overcoming those challenges.

Read More
Legit Security | How CNAPP works and why it's a critical component of an effective code to cloud application security strategy.

Scaling Security in Cloud-Native Environments with CNAPP

December 04, 2023

How CNAPP works and why it's a critical component of an effective code to cloud application security strategy.

Read More
Legit Security | How ASPM helps AppSec and Developers reduce friction and shift security left using deep context from the Legit Security ASPM solution.

Rethinking shift left: How a lack of context creates unnecessary friction between AppSec and Developers

November 27, 2023

How ASPM helps AppSec and Developers reduce friction and shift security left using deep context from the Legit Security ASPM solution.

Read More
Legit Security | Explore the evolution of Software Bill of Materials (SBOM) in application security, its significance, and optimization strategies.

Best Practices for Managing & Maintaining SBOMs

November 08, 2023

Explore the evolution of Software Bill of Materials (SBOM) in application security, its significance, and optimization strategies.

Read More
Legit Security | Dive into the world of software secrets, learn best practices for secure CI/CD, and safeguard sensitive data in this comprehensive guide.

A Guide to Securing Secrets in CI/CD Pipelines

October 27, 2023

Dive into the world of software secrets, learn best practices for secure CI/CD, and safeguard sensitive data in this comprehensive guide.

Read More
Legit Security | Uncovering 'AIJacking': How Attackers Exploit Hugging Face for AI Supply Chain Attacks - A Deep Dive into Vulnerabilities and Risks.

Legit Discovers "AI Jacking" Vulnerability in Popular Hugging Face AI Platform

October 24, 2023

Uncovering 'AIJacking': How Attackers Exploit Hugging Face for AI Supply Chain Attacks - A Deep Dive into Vulnerabilities and Risks.

Read More
Legit Security | Discover the evolution of Application Security Orchestration (ASOC) to Application Security Posture Management (ASPM) in today's threat landscape.

Unlocking the Future of Application Security: Evolution from ASOC to ASPM

October 12, 2023

Discover the evolution of Application Security Orchestration (ASOC) to Application Security Posture Management (ASPM) in today's threat landscape.

Read More
Legit Security | Uncover the security concerns in the era of AI and LLMs, delving into code opacity and application embedding risks.

The Risks of Being Blind to AI in Your Own Organization

October 10, 2023

Uncover the security concerns in the era of AI and LLMs, delving into code opacity and application embedding risks.

Read More
Legit Security | Unlock Cloud Security with CNAPP: Discover benefits and choose the right provider in our guide to safeguarding your cloud environment.

How CNAPP Is Taking Cloud Security to the Next Level

September 29, 2023

Unlock Cloud Security with CNAPP: Discover benefits and choose the right provider in our guide to safeguarding your cloud environment.

Read More
Legit Security | Explore Cloud Application Security: Risks, Benefits, and Best Practices for a Secure Cloud Environment.

Don’t Snooze on These Cloud Application Security Best Practices

September 20, 2023

Explore Cloud Application Security: Risks, Benefits, and Best Practices for a Secure Cloud Environment.

Read More
Legit Security | Explore Legit Security's revolutionary AI application security, risks, and solutions in our blog.

Securing AI-Generated Code

September 18, 2023

Explore Legit Security's revolutionary AI application security, risks, and solutions in our blog.

Read More
Legit Security | Explore the collaborative effort by OpenSSF and leading security vendors in the release of SCM Best Practices Guide.

OpenSSF SCM Best Practices Guide Released With Contributions From Legitify

September 13, 2023

Explore the collaborative effort by OpenSSF and leading security vendors in the release of SCM Best Practices Guide.

Read More
Legit Security | Dive into NIST's SP 800-204D IPD: Secure DevSecOps CI/CD Pipelines Guide. Get strategies for software supply chain security integration.

From Theory to Practice: Navigating NIST's CI/CD Security Strategies

September 11, 2023

Dive into NIST's SP 800-204D IPD: Secure DevSecOps CI/CD Pipelines Guide. Get strategies for software supply chain security integration.

Read More
Legit Security | Master vulnerability management: Learn to secure your organization with effective strategies & modern best practices in this guide.

Top Vulnerability Management Tools, Tips and Best Practices

September 05, 2023

Master vulnerability management: Learn to secure your organization with effective strategies & modern best practices in this guide.

Read More
Legit Security | Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

Legit Security and CrowdStrike: Securing Applications from Code Creation to Cloud Deployment

August 29, 2023

Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

Read More
Legit Security | Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

Legit Security ASPM Platform Update: Accelerating AppSec Efficiency and Effectiveness

August 21, 2023

Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

Read More
Legit Security | Learn how CSPM and ASPM work together to secure cloud ops. Enhance cloud security with insights on integration and protection strategies.

Optimize And Extend Cloud Security Posture Management

August 14, 2023

Learn how CSPM and ASPM work together to secure cloud ops. Enhance cloud security with insights on integration and protection strategies.

Read More
Legit Security | Learn to master the vulnerability management lifecycle. Safeguard against threats, implement best practices, and ensure compliance.

An In-Depth Guide to the Vulnerability Management Lifecycle

August 07, 2023

Learn to master the vulnerability management lifecycle. Safeguard against threats, implement best practices, and ensure compliance.

Read More
Legit Security | Learn how the use of Large Language Models (LLMs) like OpenAI's GPT and Google's Bard can create security risks in your applications.

Emerging Risks with Embedded LLM in Applications

August 02, 2023

Learn how the use of Large Language Models (LLMs) like OpenAI's GPT and Google's Bard can create security risks in your applications.

Read More
Legit Security | CI/CD automates software development, while self-hosted runners enable general customization. SaaS platforms provide limited control.

Securing Your CI/CD Pipeline: Exploring the Dangers of Self-Hosted Runners

July 26, 2023

CI/CD automates software development, while self-hosted runners enable general customization. SaaS platforms provide limited control.

Read More
Legit Security | Discover how to safeguard your software applications from vulnerabilities, protect sensitive data, and stay ahead of the competition.

8 Tips to Maximize Application Security Testing

July 25, 2023

Discover how to safeguard your software applications from vulnerabilities, protect sensitive data, and stay ahead of the competition.

Read More
Legit Security | This article will review what Shifting Security Left means, the benefits, and why you should implement it in your DevOps process. 

It’s Time to Shift Security Left with These Best Practices

July 14, 2023

This article will review what Shifting Security Left means, the benefits, and why you should implement it in your DevOps process. 

Read More
Legit Security | This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

How We Found Another GitHub Actions Environment Injection Vulnerability in a Google Project

July 03, 2023

This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

Read More
 Legit Security | This blog analyzes trends in application security and predicts the future direction of enterprise application security programs.

2023 Predictions for Modern Application Security

July 03, 2023

This blog analyzes trends in application security and predicts the future direction of enterprise application security programs.

Read More
Legit Security | Strengthen cybersecurity with SCA and SAST. Learn their methods, benefits, and usage. Safeguard against software supply chain threats.

Stepping Up Cybersecurity: An In-depth Look at SCA and SAST

June 27, 2023

Strengthen cybersecurity with SCA and SAST. Learn their methods, benefits, and usage. Safeguard against software supply chain threats.

Read More
Legit Security | Learn about core functionality, benefits, and guidance on choosing the right vulnerability management tool for enhanced cybersecurity.

Best Vulnerability Management Tools Used by Enterprises

June 20, 2023

Learn about core functionality, benefits, and guidance on choosing the right vulnerability management tool for enhanced cybersecurity.

Read More
Legit Security | Learn how SSDF can enhance your code's security, safeguard your business, and stay ahead of future needs as cyber threats increase.

How to Stay Ahead of Future Requirements for the NIST SSDF

June 02, 2023

Learn how SSDF can enhance your code's security, safeguard your business, and stay ahead of future needs as cyber threats increase.

Read More
Legit Security | On May 20th, PyPI (the official Python Package manager) announced they are temporarily suspending new users and new project registration.

Embracing the Future of Secure Software Development: A Comprehensive Look at the SSDF

May 25, 2023

On May 20th, PyPI (the official Python Package manager) announced they are temporarily suspending new users and new project registration.

Read More
Legit Security | On May 20th, PyPI (the official Python Package manager) announced they are temporarily suspending new users and new project registration.

Supply Chain Attacks Overflow: PyPI Suspended New Registrations

May 22, 2023

On May 20th, PyPI (the official Python Package manager) announced they are temporarily suspending new users and new project registration.

Read More
Legit Security | In this blog series, we uncover the details of SLSA provenance which refers to the ability to trust the authenticity of artifacts.

SLSA Provenance Blog Series, Part 2: Deeper Dive Into SLSA Provenance

May 22, 2023

In this blog series, we uncover the details of SLSA provenance which refers to the ability to trust the authenticity of artifacts.

Read More
Legit Security | Get insights into the elements of ASPM to learn how this approach transforms AppSec and enables teams to deliver securely at scale. 

What is Application Security Posture Management – Insights Into Gartner’s® New Report

May 15, 2023

Get insights into the elements of ASPM to learn how this approach transforms AppSec and enables teams to deliver securely at scale. 

Read More
Legit Security | In this blog series, we uncover the details of SLSA provenance which refers to the ability to trust the authenticity of artifacts.

SLSA Provenance Blog Series, Part 1: What Is Software Attestation

May 09, 2023

In this blog series, we uncover the details of SLSA provenance which refers to the ability to trust the authenticity of artifacts.

Read More
Legit Security | Learn the risks of exposing secrets through leaked source code and why traditional code scanners may not be enough to fight threats.

New Techniques Attackers Are Using to Harvest Your Secrets

April 25, 2023

Learn the risks of exposing secrets through leaked source code and why traditional code scanners may not be enough to fight threats.

Read More
Legit Security | Protect your business from the serious consequences of code leaks by taking proactive measures to enhance your cybersecurity posture.

The Business Risks and Costs of Source Code Leaks and Prevention Tips

April 24, 2023

Protect your business from the serious consequences of code leaks by taking proactive measures to enhance your cybersecurity posture.

Read More
Legit Security | We talk about why you need code to cloud traceability to modernize your application security and secure your SDLC and CI/CD processes.

Modern AppSec Needs Code to Cloud Traceability

April 17, 2023

We talk about why you need code to cloud traceability to modernize your application security and secure your SDLC and CI/CD processes.

Read More
Legit Security | With the explosion of attacks in the modern DevOps stack, it has become a vital business requirement to provide security for SDLC.

Tips to Secure the Software Development Lifecycle (SDLC) in Each Phase

April 12, 2023

With the explosion of attacks in the modern DevOps stack, it has become a vital business requirement to provide security for SDLC.

Read More
Legit Security | 3CX, an international VoIP IPBX software, experienced software supply chain attack. We detail what occurred, and how it can be prevented.

Sophisticated 3CX Software Supply Chain Attack Affects Millions of Users

March 31, 2023

3CX, an international VoIP IPBX software, experienced software supply chain attack. We detail what occurred, and how it can be prevented.

Read More
Legit Security | Our team has found a vulnerability in Azure Pipelines (CVE-2023-21553) that allows an attacker to execute malicious code in a pipeline.

Remote Code Execution Vulnerability in Azure Pipelines Can Lead To Software Supply Chain Attack

March 30, 2023

Our team has found a vulnerability in Azure Pipelines (CVE-2023-21553) that allows an attacker to execute malicious code in a pipeline.

Read More
Discover 8 of the top threats to cloud applications in 2023 and learn about techniques that can be employed to help keep your cloud applications secure.

The Top 8 Cloud Application Threats in 2023

March 14, 2023

Discover 8 of the top threats to cloud applications in 2023 and learn about techniques that can be employed to help keep your cloud applications secure.

Read More
Legit Security | Our team investigated how sensitive information can get exposed via SDLC tools that may be used as part of your development pipeline.

Exposing Secrets Via SDLC Tools: The Artifactory Case

February 28, 2023

Our team investigated how sensitive information can get exposed via SDLC tools that may be used as part of your development pipeline.

Read More
Legit Security | We cover how to perform application security risk assessments that allow you to maintain innovative and rapid app development strategy.

5 Best Practices for Successful Application Risk Assessments

February 15, 2023

We cover how to perform application security risk assessments that allow you to maintain innovative and rapid app development strategy.

Read More
Legit Security | This blog covers tips to strengthen software supply chain security when relying on open-source software.

Top Open Source Software Supply Chain Security Tips

February 13, 2023

This blog covers tips to strengthen software supply chain security when relying on open-source software.

Read More
Legit Security | This blog details the SDLC (Software Development Life Cycle), a breakdown of all the stages involved in software creation.

What is a Secure SDLC?

February 07, 2023

This blog details the SDLC (Software Development Life Cycle), a breakdown of all the stages involved in software creation.

Read More
Legit Security | We cover GUAC and its value for your team once GUAC reaches maturity and untangle the complexity of security and dependency metadata.

GUAC Explained in 5 Minutes

January 31, 2023

We cover GUAC and its value for your team once GUAC reaches maturity and untangle the complexity of security and dependency metadata.

Read More
Legitify is an open-source GitHub and GitLab configuration scanner from Legit Security that helps manage & enforce SCM configuration best practices in a secure and scalable way

Legitify adds support for GitLab and GitHub Enterprise Server

January 25, 2023

Legitify is an open-source GitHub and GitLab configuration scanner from Legit Security that helps manage & enforce SCM configuration best practices in a secure and scalable way

Read More
Legit Security | This blog details the five elements of the NIST cybersecurity framework and identifies the critical aspects of protecting any org.

What are the Five Elements of the NIST Cybersecurity Framework?

January 23, 2023

This blog details the five elements of the NIST cybersecurity framework and identifies the critical aspects of protecting any org.

Read More
Legit Security | We investigate how sensitive information can get exposed via AppSec tools that you use in your dev pipeline, using the SonarQube Case.

Exposing Secrets Via SDLC Tools: The SonarQube Case

January 19, 2023

We investigate how sensitive information can get exposed via AppSec tools that you use in your dev pipeline, using the SonarQube Case.

Read More
We explore our findings in a popular implementation vulnerability of the markdown engine and potential Denial-of-Service (DoS) attack that it could cause.

The MarkdownTime Vulnerability: How to Avoid This DoS Attack on Business Critical Services

January 18, 2023

We explore our findings in a popular implementation vulnerability of the markdown engine and potential Denial-of-Service (DoS) attack that it could cause.

Read More
See how attackers used compromised Jenkins plugins to attack the software supply chain and how to continuously detect vulnerable Jenkins plugins at scale.

How to Continuously Detect Vulnerable Jenkins Plugins to Avoid a Software Supply Chain Attack

January 04, 2023

See how attackers used compromised Jenkins plugins to attack the software supply chain and how to continuously detect vulnerable Jenkins plugins at scale.

Read More
DevOps is a good approach to improving the efficiency of the software development life cycle, but, DevSecOps is the better way to approach the process.

A DevOps Security Tutorial for Digital Business Leaders

December 28, 2022

DevOps is a good approach to improving the efficiency of the software development life cycle, but, DevSecOps is the better way to approach the process.

Read More
Examining the evolution of application security and why securing the modern SDLC requires organizations to embrace new approaches to supply chain security.

Modern AppSec Requires Extending Beyond SCA and SAST

December 06, 2022

Examining the evolution of application security and why securing the modern SDLC requires organizations to embrace new approaches to supply chain security.

Read More
 New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

Novel Pipeline Vulnerability Discovered; Rust  Found Vulnerable

December 01, 2022

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

Read More
Legit Security | There are different approaches to software supply chain security. Find out which is best for your software security needs.

Top Software Supply Chain Security Solution Approaches: Pros and Cons

November 29, 2022

There are different approaches to software supply chain security. Find out which is best for your software security needs.

Read More
OpenSSL has announced a critical fix in version 3.0.7 to be released Nov 1st. It means that on Tuesday the race will start between those who patch and those who exploit.

Critical and Time Sensitive OpenSSL Vulnerability - The Race Between Attackers and Defenders

October 31, 2022

OpenSSL has announced a critical fix in version 3.0.7 to be released Nov 1st. It means that on Tuesday the race will start between those who patch and those who exploit.

Read More
On Oct 7th, Toyota announced a possible data leakage incident. The compromised data contained 296,019 customers' private information, including customers' personal email addresses.

Toyota Customer Data Leaked Due To Software Supply Chain Attack

October 12, 2022

On Oct 7th, Toyota announced a possible data leakage incident. The compromised data contained 296,019 customers' private information, including customers' personal email addresses.

Read More
If you haven’t already been integrating security into DevOps, now’s the time. Learn about the benefits & use this 4-step guide to secure your DevOps.

Integrating Security into DevOps: A Step-By-Step Guide

October 11, 2022

If you haven’t already been integrating security into DevOps, now’s the time. Learn about the benefits & use this 4-step guide to secure your DevOps.

Read More
Legitify is an open-source GitHub configuration scanner from Legit Security that helps manage & enforce GitHub configurations in a secure and scalable way

Introducing Legitify: A Better Way To Secure GitHub

October 05, 2022

Legitify is an open-source GitHub configuration scanner from Legit Security that helps manage & enforce GitHub configurations in a secure and scalable way

Read More
On the 29th of September, it was revealed that the installer for the widely used Comm100 Live Chat application included malicious trojan malware. The installer was compromised using a supply chain attack on the Comm100 development pipeline.

Software Supply Chain Attack Leads to Trojanized Comm100 Installer

October 03, 2022

On the 29th of September, it was revealed that the installer for the widely used Comm100 Live Chat application included malicious trojan malware. The installer was compromised using a supply chain attack on the Comm100 development pipeline.

Read More
GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

GitHub Codespaces Security Best Practices

September 28, 2022

GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

Read More
As software technology continues to evolve, it’s become more important than ever to ensure a secure software supply chain. Here are 4 types of risks every CISO should know.

Software Supply Chain Risks: What Every CISO Needs to Know

September 22, 2022

As software technology continues to evolve, it’s become more important than ever to ensure a secure software supply chain. Here are 4 types of risks every CISO should know.

Read More
Malicious actors are poisoning your artifacts in an attempt to infect your software supply chain so that you deploy those compromised artifacts to your production servers.

Why You Can Still Get Hacked Even After Signing Your Software Artifacts

September 19, 2022

Malicious actors are poisoning your artifacts in an attempt to infect your software supply chain so that you deploy those compromised artifacts to your production servers.

Read More
A popular vendor of Magento-Wordpress plug-ins/integrations with 200,000 downloads, has been hacked. This attack is a reminder that malicious 3rd party plug-ins for popular platforms, in this case FishPig integrations for Magento e-commerce platforms, can open the door to critical vulnerabilities.

New Software Supply Chain Attack Installs Trojans on Adobe's Magento E-Commerce Platform

September 15, 2022

A popular vendor of Magento-Wordpress plug-ins/integrations with 200,000 downloads, has been hacked. This attack is a reminder that malicious 3rd party plug-ins for popular platforms, in this case FishPig integrations for Magento e-commerce platforms, can open the door to critical vulnerabilities.

Read More
Discover the four types of threats to business software supply chains and the 8 best practices in risk management to help keep them secure.

8 Best Practices in Cyber Supply Chain Risk Management to Stay Safe

September 13, 2022

Discover the four types of threats to business software supply chains and the 8 best practices in risk management to help keep them secure.

Read More
GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Attackers Can Bypass GitHub Required Reviewers to Submit Malicious Code

September 08, 2022

GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Read More
Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

Google & Apache Found Vulnerable to GitHub Environment Injection

September 01, 2022

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

Read More
Agile development methodology has become increasingly popular, but it doesn’t come without security concerns. Get to know the top 10 agile software development security concerns you face.

10 Agile Software Development Security Concerns You Need to Know

August 31, 2022

Agile development methodology has become increasingly popular, but it doesn’t come without security concerns. Get to know the top 10 agile software development security concerns you face.

Read More
LastPass disclosed that an unauthorized party had gained access to portions of the LastPass developer environment. An attacker gained access to developer account credentials and used them to exfiltrate portions of their proprietary source code.

LastPass Software Supply Chain Attack: What Happened and Tips to Protect Against Similar Attacks

August 29, 2022

LastPass disclosed that an unauthorized party had gained access to portions of the LastPass developer environment. An attacker gained access to developer account credentials and used them to exfiltrate portions of their proprietary source code.

Read More
AppSec isn’t always top of mind - but it should be. And here’s why. Learn about the 5 things you need to know about application security in DevOps.

5 Things You Need to Know About Application Security in DevOps

August 22, 2022

AppSec isn’t always top of mind - but it should be. And here’s why. Learn about the 5 things you need to know about application security in DevOps.

Read More
Earlier today, Stephan Lacy published a Twitter post about a massive attack on GitHub. Even though later it was understood that none of the original GitHub repositories was infected, the attack attempt is a huge deal.

Breaking News: How a Massive Malware Attack Almost Occurred on GitHub

August 03, 2022

Earlier today, Stephan Lacy published a Twitter post about a massive attack on GitHub. Even though later it was understood that none of the original GitHub repositories was infected, the attack attempt is a huge deal.

Read More
Create a Secure Software Supply Chain in 10 Easy Steps

In today’s age of security breaches, it’s more important than ever to create a secure software supply chain. Follow these 10 easy steps to keep your business safe.

How to Secure Your Software Supply Chain in 10 Steps

August 02, 2022

Create a Secure Software Supply Chain in 10 Easy Steps In today’s age of security breaches, it’s more important than ever to create a secure software supply chain. Follow these 10 easy steps to keep your business safe.

Read More
This blog guides you through the implementation of SSDLC methodologies, aiming to incorporate security directly within the Software Development Lifecycle.

A Complete Guide to the Secure Software Development Lifecycle (SDLC)

July 18, 2022

This blog guides you through the implementation of SSDLC methodologies, aiming to incorporate security directly within the Software Development Lifecycle.

Read More
Securing your SDLC is an important part of any business. That’s why we’ve put together a list that will help set your organization up for success.

Secure SDLC: The Best Advice for Securing Your Code and Application Data in 2022 and Beyond

July 05, 2022

Securing your SDLC is an important part of any business. That’s why we’ve put together a list that will help set your organization up for success.

Read More
GitHub makes it easy for developers to collaborate, but it’s also easy for bad actors to exploit misconfigurations and vulnerabilities.

Securing GitHub: How to Keep Your Code and Pipelines Safe from Hackers

June 20, 2022

GitHub makes it easy for developers to collaborate, but it’s also easy for bad actors to exploit misconfigurations and vulnerabilities.

Read More
A review of our contributions to the open source community and why the open source community is important to the future of software supply chain security.

The Open Source Community And Its Critical Role in Software Supply Chain Security

June 13, 2022

A review of our contributions to the open source community and why the open source community is important to the future of software supply chain security.

Read More
An application risk assessment is an essential tool to help security and development teams spot hidden vulnerabilities before they become a problem.

A 10-Step Application Security Risk Assessment Checklist

June 06, 2022

An application risk assessment is an essential tool to help security and development teams spot hidden vulnerabilities before they become a problem.

Read More
This article will explain why security and GitHub should go hand in hand and describes a few best practices we believe any organization using GitHub should employ to reduce GitHub security risks.

GitHub Security Best Practices Your Team Should Be Following

May 31, 2022

This article will explain why security and GitHub should go hand in hand and describes a few best practices we believe any organization using GitHub should employ to reduce GitHub security risks.

Read More
DevOps security tools aren’t just for boosting security - they can help boost your productivity, too. Here’s how to get the most out of your DevSecOps tools.

How to Use DevOps Security Tools to Protect Your Business

May 23, 2022

DevOps security tools aren’t just for boosting security - they can help boost your productivity, too. Here’s how to get the most out of your DevSecOps tools.

Read More
News flash: it’s time to forget everything you thought you knew about DevOps and Security. Here’s why you should adopt a fresh take on DevSecOps.

Forget Everything You Thought You Knew About DevOps and Security

May 16, 2022

News flash: it’s time to forget everything you thought you knew about DevOps and Security. Here’s why you should adopt a fresh take on DevSecOps.

Read More
Some tags cannot be trusted to reference the same object all the time, and can be changed without the users’ knowledge, opening the door to a supply chain attack.

What Are Immutable Tags And Can They Protect You From Supply Chain Attacks?

May 09, 2022

Some tags cannot be trusted to reference the same object all the time, and can be changed without the users’ knowledge, opening the door to a supply chain attack.

Read More
We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

May 02, 2022

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Read More
AppSec and DevSecOps leaders need to secure the business from increasing software supply chain attacks, while improving their overall AppSec effectiveness and efficiency.

Re-thinking Application Security for DevSecOps and Scale

April 25, 2022

AppSec and DevSecOps leaders need to secure the business from increasing software supply chain attacks, while improving their overall AppSec effectiveness and efficiency.

Read More
This GitHub OAuth access token attack was announced by GitHub Security and is a compromise of OAuth access tokens issued to Heroku and Travis-CI integrations.

Latest GitHub OAuth Tokens Attack Explained and How to Protect Yourself

April 18, 2022

This GitHub OAuth access token attack was announced by GitHub Security and is a compromise of OAuth access tokens issued to Heroku and Travis-CI integrations.

Read More
What is an #SBOM, how is it used and why it is important to software supply chain security? We explain the SBOM in 5 minutes, discuss where SBOM adoption is headed and help you think beyond SBOM to gain greater visibility and security across your entire software supply chain environment.

What is an SBOM? SBOM explained in 5 minutes

April 11, 2022

What is an #SBOM, how is it used and why it is important to software supply chain security? We explain the SBOM in 5 minutes, discuss where SBOM adoption is headed and help you think beyond SBOM to gain greater visibility and security across your entire software supply chain environment.

Read More

Request a demo including the option to analyze your own software supply chain.