If over 40 major banks can be the target of JavaScript injection attacks, let’s be honest – so can you. In 2023, a malware campaign using this attack method affected 50,000 user sessions across more than 40 financial institutions worldwide, leaving many dev teams in pure damage-control mode. 67.9% of professional developers use JavaScript more often than any other programming language. Its popularity is understandable, given its versatile and interactive capabilities.

In the evolving landscape of software development, where dependencies and third-party packages are increasingly baked into the fabric of our applications, understanding and managing the risk associated with these components has become paramount.

As a company building a SaaS security product, our inherent culture is not only focused on building best of breed security products for our users, but also ensuring that our systems, practices and workflows are engineered to support a continuously evolving threat landscape, and to protect our users’ data. We’ve written about our design for tenant isolation for our serverless based architecture in the past, and practical methods to avoid data leakage between clients.

With the growing number of security frameworks, acronyms, scoring systems, benchmarks and more, it’s often hard to understand how each frameworks differs, how and where they come into play with regards to modern cloud native systems. More than anything, how do we actually operationalize these frameworks to derive engineering benefits?

How many security tools do you use daily? If you’re like 35% of developers, it’s probably too many for your liking. Building a DevSecOps toolchain is key to making DevSecOps a success and reaping all of its benefits. However, knowing where to start with so many different tools and processes can be overwhelming. This article will explain the key DevSecOps tools and processes, while providing a guidance for building a software security program that works for you.

Infrastructure as code (IaC) provides an innovative approach to provisioning and managing cloud infrastructure through code, instead of doing it through manual processes. This foundational shift not only accelerates development cycles but also introduces new dimensions of risk that must be carefully managed. In this article, we'll delve into these challenges and explore strategies to secure IaC environments from potential vulnerabilities and threats.