Tim Olshansky

Build security @Fencer_Security

[Urban @urbanskudnik]

@dok2001 I've noticed that SNI and host overrides are still in enterprise plan (https://t.co/s0mV4EiQpF) - any chance we can get that in other plans too given your very generous policy of everything in every plan (https://t.co/Pwh3CRR2Lg)? 🙏🙇☺️

[Tim Olshansky @timolsh]

@LoganTGott System

[Anže Pečar @anze3db]

Make sure to always reuse your botoclients. Initializing a fresh one on each task has A LOT of overhead!

[Fencer @fencer_security]

Engineering capacity at a startup is finite. Security is one of the things asking for a piece of it.

Here's Tim Olshansky on how to stop running security as a parallel program to product and start budgeting it as part of engineering capacity instead:

https://t.co/X6xvNjoGiV

[Tim Olshansky @timolsh]

Friends! I've built a cool little tool for reviewing security reports, starting with SOC 2 that I'm looking to recruit testers for. Comment in thread or DM and I'll share it with you - would love any/all feedback 🙏

[Fencer @fencer_security]

New: a field guide on running security at a startup, from someone who lived it.

Our co-founder @timolsh was a CTO at a startup before he built Fencer. He built and ran the security program himself. Led the company through SOC 2 with no security team to hand it to.

He wrote down what he wishes someone had handed him then.

Startup Security: A Field Guide for CTOs covers:

👉 When security stops being a "someday" problem
👉 Where your hours actually go when you're the one doing the work
👉 What to put in place first
👉 How to run security operations without burning out the team
👉 Considerations for startups in the AI era

Read it here: https://t.co/t0Cy0TIMU4

[Tim Olshansky @timolsh]

@bnj I’m building @fencer_security and would love to come check out the space. Working on a few things right now that would really benefit from design help 🙏

[Tim Olshansky @timolsh]

@MaxBrodeurUrbas @satyanadella The most challenging platform I’ve ever built on. Nothing works and nothing makes sense. Have to wade through ungodly amounts of documentation to figure out that it still doesn’t work.

[Jamieson O'Reilly @theonejvo]

Trust me chat. Forget about Glasswing spamming 0days in your software, you're already cooked with current models.

I've hacked hundreds of global orgs, including governments (legally) over the last 10 years, and the amount of times I required a 0day to do so was exactly 0 times.

Being worried about Glasswing is like living in Europe and being worried about Northrup Grumman having lethal space lasers while you're more likely to get stabbed by a crazy person walking through the streets.

[Tim Olshansky @timolsh]

@GergelyOrosz We built @fencer_security to do that and more

[Tim Olshansky @timolsh]

@0xgaut What does it mean when you have all of them? 🤦‍♂️

[sarah guo @saranormous]

I know its "another tuesday" guys, but what(!) is happening in security right now

[Tim Olshansky @timolsh]

Trivy, LiteLLM, now Axios. Damn malware is hitting hard and fast now. A few small shifts that close most of the security gap:

* Add a 3–7 day delay on new package versions with package cooldowns (minimumReleaseAge)
* Disable install scripts (--ignore-scripts)
* Only install from lockfiles (--frozen-lockfile)
* Upgrade on a schedule, not on deploy

Attackers rely on speed. You don’t have to.

[Anže Pečar @anze3db]

With recent Python supply chain attacks (Trivy/LiteLLM), it’s worth mentioning uv’s `exclude-newer = "x days"` config.

It forces uv to only installs packages published more than x days ago, reducing risks since problematic packages should be yanked by then.

[Tim Olshansky @timolsh]

@ryancarson @corazoncap @saramfoster @efosta @HamelHusain @shl Congrats @ryancarson!

[Tim Olshansky @timolsh]

@josevalim I'd go with Vanta or Drata (we use Drata) - both are solid platforms and have a somewhat "arms-length" relationship with their auditors. Anyone that offers to include an audit and manages the audit themselves are not too dissimilar to you-know-who.

[Tim Olshansky @timolsh]

The even bigger problem is that SOC2 doesn’t even have standards. You just need to prove that you’re doing what you said you’d be doing even if what you’re doing is completely useless.

I’ve seen companies with Vulnerability Management policies with no SLAs or commitment to resolving the issue

[Tim Olshansky @timolsh]

@shravvmehtaa Us too @shravvmehtaa - we are providing proper security tooling and testing to affected folks. Would love to partner and integrate @fencer_security with Secureframe

[Tim Olshansky @timolsh]

@usebland If you’re worried that your security posture isn’t as strong as you’d like because of this, we would be happy to help @fencer_security

https://t.co/vDcZAcHzVO

[Vladik Rikhter @vrikhter]

If you were impacted by the recent Delve issues and want to harden your security posture, we (@fencer_security ) will be happy to help you out.

For anyone that signs up in the next two weeks, we will give you 15% off an annual subscription and provide white glove onboarding ourselves. This will include our full platform of code, infrastructure, runtime protection, static code analysis (SAST), dynamic application security testing (DAST), identity management and SIEM.

We typically work with software companies between 20 and 500 employees.

While we don’t ourselves do the compliance part, we integrate with many of the large vendors in the industry (Vanta, Drata, etc.)

Feel free to DM me or comment below.

[Vladik Rikhter @vrikhter]

If you were impacted by the recent Delve issues and want to harden your security posture, we (@fencer_security ) will be happy to help you out.

For anyone that signs up in the next two weeks, we will give you 15% off an annual subscription and provide white glove onboarding ourselves. This will include our full platform of code, infrastructure, runtime protection, static code analysis (SAST), dynamic application security testing (DAST), identity management and SIEM.

We typically work with software companies between 20 and 500 employees.

While we don’t ourselves do the compliance part, we integrate with many of the large vendors in the industry (Vanta, Drata, etc.)

Feel free to DM me or comment below.