Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

November 2024

Understanding command injection vulnerabilities in Go

Go developers might need to use system commands for various scenarios, such as image manipulation, where they need to process or resize images or execute system commands to manage resources or gather metrics or logs. At other times, perhaps you are building a new system in Go that needs to interface with existing legacy systems. This interface leans on executing system commands and processing their output.

Snyk named a Customer Favorite in The Forrester Wave: Software Composition Analysis Software, Q4 2024 Report

Snyk is proud to announce that our developer security platform has been recognized as a Leader in The Forrester Wave: Software Composition Analysis (SCA) Software, Q4 2024 report. In this evaluation, we were one of just three Leaders and were named a Customer Favorite.

How ASPM boosts visibility to manage application risk

How often are you surprised by a threat or vulnerability from a software asset you never knew existed? For many companies, the answer is, “More often than we’d like.” This is because you can’t protect what you can’t see. Full visibility across the entire software supply chain is a must for AppSec teams, but this comprehensive view across the attack surface can be elusive.

Extending Developer Security with Dev-First Dynamic Testing

Today, we announced the exciting news that Snyk has acquired Probely, a fast-growing modern provider of API Security Testing and Dynamic Application Security Testing (DAST). With this addition, Snyk now offers a full range of development and application security solutions, with customers immediately benefiting from a broader range of developer friendly testing techniques.

GitFlops: The Dangers of Terraform Automation Platforms

Terraform is today’s leading Infrastructure-as-Code platform, relied upon by organizations ranging from small startups to multinational corporations. It enables teams to declaratively manage their cloud or on-premises infrastructure, allowing them to provision or decommission infrastructure components simply, consistently, and with auditability.

If you don't know about HTTP Archive's Web Almanac yet, you should!

Most, if not all, of us in the software development space have benefitted from community-driven projects at some point. We’ve tapped into open source libraries, searched for advice on Reddit, and posted our seemingly unsolvable questions on Stack Overflow. But you might be missing out on a community project that especially excites me. It’s the Web Almanac, a collaborative report that provides tons of valuable insights into how people build and use the web.