In-depth technical guides, compiler internals, and practical supply-chain security research written by and for software engineers.
Why regex string matching fails on modern codebases. A deep technical breakdown of AST node traversal, cyclomatic complexity, and taint flow in JavaScript and Python.
A deep dive into why National Vulnerability Database (NVD) matching causes false positives in lockfiles, and how the Open Source Vulnerabilities (OSV) schema resolves commit-level zero-days.
An architectural exploration of network copyleft clauses in AGPL-3.0 and SSPL-1.0. How third-party open-source libraries can inadvertently infect proprietary cloud software.
How AWS keys, Stripe secrets, and database credentials slip into git commits. A deep dive into Shannon entropy heuristics, Gitleaks pattern detection, and ephemeral PR protection.
How Semgrep provides high-speed Static Application Security Testing (SAST). Writing custom rules, tracking untrusted user input, and intercepting OWASP Top 10 vulnerabilities.
Apply these security practices to your own repositories. Run real-time zero-day checks and SPDX license classifications with zero setup.