2015–2019
275 posts
2019 141
December 2019
- Building security into your Azure DevOps Pipeline
- Integrating actionable security in your CI/CD workflow and build systems with Snyk tests
- Snyk Receives “Best CEO” Award
- Malicious packages found to be typo-squatting in Python Package Index
- Deploying a Gatsby site to GitHub Pages from Travis CI
November 2019
- Creating a Language for Security with Chef’s Adam Jacob
- Snyk’s defining values
- Snyk Unifies Open Source and Container Security for Coveo
- What’s so wild about exploits in the wild - and how can we prioritize accordingly?
- Open Source Vulnerabilities and Security with Microsoft’s Jeff McAffer
- Showing application vulnerabilities in Kubernetes-native tooling
- Write secure Kubernetes configuration with help from Snyk
- Uncharted territory - discovering vulnerabilities in public Helm Charts
- Security digital transformation with James Kaplan
- Shipping Kubernetes-native applications with confidence
- See Snyk and GitHub in action at GitHub Universe
- Secure your Kubernetes applications with Snyk Container
- Putting container security in the hands of developers
- Using third party content securely
- Keep your dependencies up-to-date—enable auto upgrades with Snyk
October 2019
- From image security to workload security
- Comparing React and Angular secure coding practices
- 84% of all websites are impacted by jQuery XSS vulnerabilities
- JavaScript frameworks security report 2019
- Angular vs React: security bakeoff 2019
- 2019 side-by-side comparison of Angular and React security vulnerabilities
- Angular vs React: the security risk of indirect dependencies
- Shifting security left means culture, not just tools
- A recap from our latest PCI webinar, and compliance tips from Deliveroo
- Container security throughout the SDLC
- Snyk joins CloudBees new Technical Alliance Partner Program as Premier launch member
- A Snyk peek into Node.js and npm’s state of open source security report 2019
- Using Open Policy Agent (OPA) for cloud security and compliance
- Trend Micro and Snyk partner to deliver complete remediation to secure containers
- Shifting compliance left: Helping legal teams and developers cooperate around licensing issues
September 2019
- The Secure Developer: talking DevSecOps in Azure with Microsoft’s Victoria Almazova
- Why npm lockfiles can be a security blindspot for injecting malicious modules
- Modern security leader spotlight: with Marcin Hoppe from Auth0
- Everything you wanted to know about addressing security vulnerabilities in Linux-based containers
- 10 Java security best practices
- Sequelize ORM npm library found vulnerable to SQL Injection attacks
- Snyk Raises $70M to Accelerate Dev-first Security
- Making climate positive changes
- 6 stages of refactoring a Jest test case
August 2019
- Open source security with O’Reilly author Guy Podjarny
- Mastering Node.js version management and npm registry sources like a pro
- Code execution back door found in Ruby’s rest-client library
- Jackson Deserialization Vulnerability
- A year-old dormant malicious remote code execution vulnerability discovered in Webmin
- Securing Artifactory using Snyk
- Automating open source security scanning with Snyk and CircleCI
- 10 Eclipse plugins you shouldn’t code without
- Kubernetes open sourced their security audit. What can we learn?
- Securing Go modules made easy (and accurately!)
- Best practices for rolling out Snyk
- Announcing new container registry integrations
- A technical analysis of the Capital One cloud misconfiguration breach
July 2019
- Staying ahead of security vulnerabilities with security patches
- Fix open source vulnerabilities directly from your Eclipse IDE
- Unique to the .NET ecosystem, 75% of the top twenty vulnerabilities have a high severity rating
- .NET open source security insights
- Remote code execution, cross-site scripting, and denial of service vulnerabilities account for 2/3 of known vulnerabilities in .NET ecosystem
- Snyk has acquired DevSecCon!
- PCI standards open source security requirements — how to comply?
- Scaling developer-first security
- How to increase Serverless observability, monitoring and security
- How SME lender New10 uses AWS and Snyk to deliver quickly and securely
- Concerns of supply-chain attacks amplify as remote code execution was found in Ruby gem strong_password
- Snyk research team discovers severe prototype pollution security vulnerabilities affecting all versions of lodash
- Serverless is great, but what about the security of my AWS Lambda functions and their dependencies?
- New O’Reilly Book: Securing Open Source Libraries by Guy Podjarny
June 2019
- Yet another malicious package found in npm, targeting cryptocurrency wallets
- Best practices for secrets management in serverless applications
- 4 benefits of visualizing your cloud infrastructure
- What’s new in Snyk?
- npm passes the 1 millionth package milestone! What can we learn?
May 2019
- 10 Serverless security best practices
- Java Top 10 Security Vulnerabilities Disclosed [2019 - List]
- Snyk Voted Next European Unicorn for B2B Enterprise
- Dependency Health—assessing package risk with Snyk
- Scoring security vulnerabilities 101: Introducing CVSS for CVEs
- CRLF injection found in popular Python dependency, urllib3
- JVM Ecosystem Survey 2019
- Understanding Amazon S3 security and compliance on AWS
- A Denial of Service vulnerability discovered in the Axios JavaScript package - affecting all versions of the popular HTTP client
- 8 Azure Repos Security Best Practices
- Never store credentials as code/config in Azure Repos
- Remove sensitive data in your files and Azure Repos history
- Tightly control access to your Azure Repos
- Add security testing to pull requests in Azure Repos
- Add a SECURITY.md file to your Azure Repos
- Provide granular permissions and groups for users in Azure Repos
- Use Personal Access Tokens with Azure Repos
- Rotate Azure Repos SSH keys and personal access tokens
- Do you know how healthy your .NET dependencies are?
- Azure Repos enriched with DevSecOps capabilities
April 2019
- Protect container images directly from your registries
- 190,000 users affected by Docker Hub’s security breach. Now what?
- How much do we really know about how packages behave on the npm registry?
- Shifting Docker security left
- The top two most popular Docker base images each have over 500 vulnerabilities
- 80% of developers are not addressing Docker security
- Take actions to improve security in your Docker images
- After three years of silence, a new jQuery prototype pollution vulnerability emerges once again
- Cheat sheet: 10 Bitbucket security best practices
- Enriched content on Snyk’s publicly available vulnerability database
- Securing Bitbucket Cloud with Snyk
- Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem
March 2019
- Introducing experimental integrity policies to Node.js
- Snyk joins the Continuous Delivery Foundation as a founding member.
- What is package lock json and how a lockfile works for yarn and npm packages?
- Snyking in - regular expression denial of service vulnerability exploit in the ms package
- Snyk provides a critical security layer for CommunityBridge, a new Linux Foundation platform
- Security Transformation and The Three Faces of DevSecOps
- Celebrate International Women’s Day with Snyk
- Top ten Docker images contain over 8000 vulnerable paths
- Secure your build workflow on Bitbucket Pipes with Snyk
February 2019
- 88% increase in application library vulnerabilities over two years
- Top ten most popular docker images each contain at least 30 vulnerabilities
- ReDoS vulnerabilities in npm spikes by 143% and XSS continues to grow
- 81% believe developers should own security, but they aren’t well-equipped
- Open source maintainers want to be secure, but 70% lack skills
- 78% of vulnerabilities are found in indirect dependencies, making remediation complex
- Snyking in - Directory traversal vulnerability exploit in the st package
- Security in the Container Registry
- So, you think your CI/CD environment is secure?
- 10 npm Security Best Practices
- Introducing The Secure Developer community
- A serious security flaw in runC can result in root privilege escalation in Docker and Kubernetes
- My first week at Snyk was at our All Hands Conference
- Scanning Docker images for key binaries - going beyond package managers
- Cloud infrastructure drift: The good, the bad, and the ugly
- NumPy arbitrary code execution vulnerability
- Launching .NET support for GitHub, Bitbucket and GitLab
- How even quick Node.js async functions can block the Event-Loop
January 2019
- Severe security vulnerability in Bower’s zip archive extraction
- Monitoring open source packages at runtime - now in open beta
- Snyk CLI drops support for Node.js 4 (Argon)
- Finding open source vulnerabilities within the Bitbucket workflow
- Snyk - Your Next Career Move!
- Snyk’s vulnerability database is no longer powering JFrog’s Xray
2018 56
December 2018
- 2018 Year in Review
- Critical Arbitrary Code Execution Vulnerability Found in Kubernetes
- The Secret To Building A Truly Successful Freemium Product and more, with Guy Podjarny
- Report Shows the Equifax Breach was "Entirely Preventable"
- Snyk highlighted on the ThoughtWorks Technology Radar
- Codefresh + Snyk = ship fast and securely
- Faster & improved tests for JavaScript lockfile based projects
- A post-mortem of the malicious event-stream backdoor
November 2018
- Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months
- Serverless Security: What’s left to protect?
- Introducing open source security runtime monitoring
- The State of Open Source Security Survey
October 2018
- JVM Ecosystem Report 2018
- JVM Ecosystem report 2018 - About your Tools
- JVM Ecosystem report 2018 - About your Platform and Application
- JVM Ecosystem report 2018 - About your processes and you
- Scaling Snyk fast with copy-paste orgs
- Launching a Free-Tier Version of our Container Vulnerability Management Solution
- IntelliJ plugin to fix vulnerable dependencies
September 2018
- 10 Maven Security Best Practices
- Snyk $22M Series B: Thanks to our community!
- Over 10% of Python packages on PyPI are distributed without a license
August 2018
- Actionable and aggregated Slack notifications
- Importing projects via the API
- 10 Spring Boot security best practices
- Behind the disclosure: the Zip Slip vulnerability
- How to crash an email server with a single email
July 2018
- How to educate, train and empower developers in security
- Revisiting unit testing and mocking in Python
June 2018
- Zip Slip Vulnerability Cheat Sheet
- Container vulnerability management for developers
- The most common vulnerabilities in Maven Central and npm
- Snyk <3 Jira
- Introducing service accounts: API tokens for your org
- Public Disclosure of a Critical Arbitrary File Overwrite Vulnerability: Zip Slip
May 2018
- Snyk Named a 2018 Gartner Cool Vendor in Application and Data Security
- JVM Ecosystem Survey 2018
- Skyscanner fixed projects and gained visibility into their open source vulnerability exposure.
April 2018
- Local Type Inference Cheat Sheet for Java 10 and beyond!
- JavaScript and Node.js Security – The Common Pitfalls
- Attacking an FTP Client: MGETting more than you bargained for
- Snyk is Now Integrated with Chrome’s Lighthouse
March 2018
- Tailoring your notifications
- DigitalOcean: Fixing a critical Ruby Gem vulnerability within a day of disclosure
- How Comic Relief’s developers used Snyk to automate security and boost productivity as part of their Digital Transformation.
- Snyk $7M Series A - and a huge thanks!
- Introducing groups – a new way to manage your teams in Snyk
February 2018
- Suppressing issues in Snyk
- Python Mocking 101: Fake it before you make it
- What’s a known vulnerability?
January 2018
- We’ll know DevSecOps has won once it’s dead
- Where do security patches come from?
- What do open source maintainers know about security?
- npm Shrinkwrap reloaded: Locking npm Deps with Package-Lock and Yarn.Lock
- Don’t build security tools, build developer tools instead
- Using the Snyk API to find and fix vulnerabilities
2017 41
December 2017
November 2017
- 77% of 433,000 sites use vulnerable JavaScript libraries
- Announcing the 2017 State of Open Source Security Report
- Exposed or not, vulnerabilities are dangerous
- Why triaging might be going away
October 2017
September 2017
- GDPR Compliance and Open Source
- Launching the State of Open Source Security Survey
- Snyk for your Enterprise
- Open source vulnerabilities tripped Equifax, how can you defend yourself?
August 2017
June 2017
- Getting the most out of snyk test with JSON
- Launching Cloud Foundry support at CF Summit
- XSS Attacks: The Next Wave
- Bitbucket Server Integration in Beta
- Snyk is available on the GOV.UK Digital Marketplace!
May 2017
April 2017
- Serverless Security at Serverless Conf
- Introducing Snyk for Serverless
- Serverless Security implications—from infra to OWASP
- Maven support is here!
- Continuously secure all apps with unlimited Snyk projects
March 2017
- 77% of sites use at least one vulnerable JavaScript library
- Type Manipulation: Escaping Template Sandboxes
- Building a Snyk Plugin for VS Code: An Interview with Peter Benjamin
- Fixing a Prototype Override Protection Bypass Vulnerability in qs
- The Frequency of Known Vulnerabilities in JavaScript Libraries
- Diagnosing and fixing memory leaks in Python
February 2017
- Announcing Snyk’s Integration with Xray
- How Voltos Uses Snyk to Secure Their Own Security Product
- Fixing XXE Vulnerabilities in Nokogiri
January 2017
2016 32
December 2016
- Building the VSTS Snyk task, an interview with Jesse Houwing
- Announcing Snyk CLI for Ruby, and more ways to fix Ruby vulnerabilities
- Differences in version handling between RubyGems and npm
November 2016
- Fixing a Remote Code Execution Vulnerability in EJS
- A brief history of modularity
- Announcing Snyk for Ruby
- Launching serverless Snyk
October 2016
- Building Security Tools Developers Love
- Yarn is Micro Secure
- Fixing Serverless Security Vulnerabilities
- Announcing Snyk for Bitbucket Pipelines
- Launching "The Secure Developer" Podcast
September 2016
August 2016
- Threat modelling For Node.js applications
- Using ES2015 Proxy for fun and profit
- What DevOps and Open Source Security have in common
- Engineering is somewhat like basketball
July 2016
- Enriching bitHound with Snyk
- HTTPS Adoption *doubled* this year
- 4 steps to address vulnerable dependencies
June 2016
- Out of Beta, plus exciting new features
- The 5 dimensions of an npm dependency
- Fixing SQL Injection: ORM is not enough
- 5 ways to get Node.js vulnerability alerts
May 2016
- Fixing `marked` XSS vulnerability
- Architecting a Serverless web application in AWS
- Mitigating ImageMagick vulnerabilities in Node.js