We've open sourced ActionsGuardHub. This tool helps identify malicious GitHub Actions.(Similar to tj-actions compromise)
We'd love for you to try it out and contribute to its development. Check out the repository here: https://t.co/CAK0izcQ35
#CyberSecurityMonth#githubsecurity
🕵️♂️ Ever wonder what your GitHub Actions are really doing behind the scenes?
With recent incidents like the compromise of popular actions such as tj-actions and reviewdog, the CI/CD supply chain is proving to be a juicy target for attackers.
We are pleased to welcome Suchith Narayan, Staff Security Engineer @Razorpay to the technical speaker lineup at VULNCON 2026.
Specializing in Application Security, Product Security, CI/CD Security, Secure Software Development, and Threat Modeling, Suchith brings extensive experience in securing modern applications and development ecosystems. His work spans critical areas including AI security, software supply chain security, vulnerability assessment, and secure code practices.
Join us at VULNCON 2026 to gain valuable perspectives on securing today's rapidly evolving technology landscape.
📍 NIMHANS Convention Centre, Bengaluru
📅 12th & 13th June, 2026
Final Chance: Last Minute Sale ends on 9th June
https://t.co/f0N3NtzFcT
#VULNCON2026 #Vulncon #AppSec #ProductSecurity #AISecurity #DevSecOps #ThreatModeling #CyberSecurity
Gryph v0.7.0 is out.
Among other improvements, it fixes a community reported vulnerability in how Gryph documents log levels and applies sensitive file content filter.
We transparently disclosed the issue via. GitHub. Assigned a CVE. Released a new version with fix.
Another day, another false positive in OSV and GHSA.
We’ve identified that the popular npm package hls.js (4.5M weekly downloads) has been incorrectly flagged as malicious in versions 1.7.0-alpha.1.0.canary.11764 and 1.7.0-alpha.1.0.canary.11765.
Despite being pulled from npm, our analysis confirms these canary versions are legitimate. Automated flagging without manual verification continues to cause unnecessary friction for developers. We have contacted GitHub to ensure this false positive is removed.
Advisories:
MAL-2026-3019
GHSA-pq9g-f2rr-m4hw
#AppSec #SupplyChainSecurity #Malware #FalsePositive #hlsjs
OpenClaw is the fastest-growing open source project, but there are no stories of running it safely in production at scale. As we started deploying agents internally at @brexHQ, we couldn’t stop thinking about this question.
Agents work, but nobody wants to give them real credentials. Instead of waiting for a solution to emerge, we decided to try a novel approach: using LLMs to judge the network traffic of an AI agent.
Today we’re announcing CrabTrap, an open-source proxy that intercepts every outbound request and blocks risky activity using LLMs, before it ever hits an external API. The results are promising; we believe it’s a meaningful step forward in the security of agent harnesses in production environments.
Try it out today.
(As a side note, it was really fun to work personally on a real systems problem again. And btw, if you want to work at a place where the CEO is building proxies at night, we’re hiring!)
Dependency cool-down enforcement is coming in PMG. npm first. Then pypi. Coupled with sandbox, it should reasonably protect developers (including us) against current day supply chain attacks.
So now someone contributing a PR to pin GitHub Actions in a repository "is" a way to compromise the repository by using imposter commits.
Trust SHA1 or keep GHAs pinned to tags. Best practices are currently shaky.
Gryph integration with OpenCode.
With this, Gryph now integrates with most popular coding agents. We are intentionally keeping the scope focussed. Log, audit, search and export for now. Security policies next.
Free and open source. Built in public.
https://t.co/v3vu6tvEoT
The new version of Gryph contains a nifty --sensitive query param. Allows you to query for all sensitive files touched by coding agents.
You can add your own sensitive file patterns or use the reasonable defaults available out of the box.
Shipping malicious package protection to your AI Agents and IDEs. Hosted MCP server.
Stop Shai-Hulud style software supply chain attacks while you are in YOLO mode.
Got this done today. Writing docs. Should be out soon.
Ever worried your AI agent might accidentally run rm -rf / or kubectl delete?
Agent Security Hooks is a security layer that
- Blocks dangerous shell commands
- Protects .env & secrets
https://t.co/XvVq6O9bN1
#AISecurity
Ever worried your AI agent might accidentally run rm -rf / or kubectl delete?
Agent Security Hooks is a security layer that
- Blocks dangerous shell commands
- Protects .env & secrets
https://t.co/XvVq6O9bN1
#AISecurity
Do you actually know which LLMs are running inside your codebase? 🕵️♂️
AI Spotter can help you get this visibility.
Scans GitHub repos, Detects AI Usage, Maps your organization's AI footprint
https://t.co/dSkka7pIN5
#AISecurity#AppSec#DevSecOps#LLM#CyberSecurity