Appsec adventures

A community post on the DevSecOps subreddit presents a report that monitors the latest releases of 78 open source security tools. The checks mentioned include vulnerable dependencies, binary reachability analysis, presence in known-exploited-vulnerability catalogs, release verification, and OpenSSF Scorecard signals. The initiative illustrates how to automate the monitoring of supply chain risk in tooling. Source: https://www.reddit.com/r/devsecops/comments/1xlxx5g/weekly_supplychain_report_for_78_oss_security/

A community discussion follows the proposal of a seven-day waiting period before new packages or versions are made available in the npm, PyPI, and pub ecosystems. The idea is to create time to detect signs of compromise or suspicious behavior before newly published dependencies spread to downstream projects. The post reports on the measure after its first days and debates its possible effects on security and the development workflow. Source: https://www.reddit.com/r/devsecops/comments/1xlfz6l/a_7day_package_cooldown_for_npm_pypi_and_pub_12/

The article uses the Binance incident as a warning about the potential impact of a compromised DevOps workstation. The company's initial investigation suggested that a compromised laptop may have allowed access to a service container and unauthorized transactions; the investigation was still ongoing. Because developer computers often have access to source code, cloud accounts, and production pipelines, protecting them and limiting their privileges is an essential part of organizational security. Source: https://www.endorlabs.com/learn/the-binance-hack-is-a-warning-developer-workstations-hold-the-keys-to-your-business

This playbook proposes four levels of maturity for teams that want to apply AI to application security, organized into two tracks: building software securely and defending systems. The material includes a self-assessment, guidance for moving from governed generation to orchestrated agents, criteria for deciding whether to build or buy solutions, and a 90-day action plan. The goal is to help AppSec leaders adopt AI with governance and practical targets. Source: https://www.endorlabs.com/learn/four-levels-for-architecting-security-into-agentic-sdlc

Endor Labs and Google Antigravity present an integration that brings security checks and fixes into the coding agent workflow, instead of relying only on a later review. The proposal lets agents plan tasks, write code, and add dependencies with specialized security tools available during development. The announcement reflects a growing trend of embedding AppSec controls directly into AI-assisted development environments. Source: https://www.endorlabs.com/learn/endor-labs-google-antigravity-secure-code-by-default-in-agentic-workflows

Bruce Schneier highlights the observation that a significant share of known critical vulnerabilities was reportedly discovered recently, raising the possibility that AI tools are accelerating flaw identification. The post draws attention to the change in scale of vulnerability discovery and to the challenge it poses for those who must verify, prioritize, and fix software problems. Source: https://www.schneier.com/blog/archives/2026/11/ai-vulnerability-finding-2.html