# product security Published articles for product security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## When AI skills become supply-chain dependencies DevFeed: [When AI skills become supply-chain dependencies]() Original publisher: [Read original article]() Author: Nubank Editorial Published: 2026-09-02T16:47:57Z Content type: article Language: en Sources: [Nubank]() Topics: [Security](), [supply-chain-security](), [Application Security](), [Development](), [Software]() Tags: [ai](), [ai-research](), [developer](), [development](), [product-security](), [security](), [supply-chain]() ### AI overview Nubank describes how AI skills and related components are expanding the software supply chain. Its security team reviewed more than 2,000 AI skills before distribution and argues that security controls must evolve as AI becomes part of the developer toolchain. ### Source excerpt How Nubank vetted 2,000+ AI skills before distribution, building security into the developer workflow without turning safety into a separate gate The post When AI skills become supply-chain dependencies appeared first on Building Nubank. ## Mitigating a rsync Vulnerability: A Lesson in Compiler Hardening DevFeed: [Mitigating a rsync Vulnerability: A Lesson in Compiler Hardening]() Original publisher: [Read original article]() Published: 2025-03-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Compiler](), [chainguard](), [Security](), [c/c++](), [vulnerability]() Tags: [c](), [c-plus-plus](), [chainguard](), [compiler-flags](), [compiler-hardening](), [cves](), [defense-in-depth](), [hardening](), [linux](), [llvm](), [product-security](), [rsync](), [security](), [x86-64]() ### AI overview Chainguard describes how compiler hardening in its C/C++ toolchain helped protect against an rsync vulnerability before public disclosure. The article presents compiler hardening flags as layers of defense for memory-unsafe software and discusses Chainguard's implementation of recommendations from OpenSSF and GCC. ### Source excerpt Chainguard's defense-in-depth security strategy protected against multiple rsync CVEs before they were even reported. See how we did it, using compiler flags. ## Chainguard Signs CISA's Secure Software Development Attestation Form DevFeed: [Chainguard Signs CISA's Secure Software Development Attestation Form]() Original publisher: [Read original article]() Published: 2025-02-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard](), [open-source-security](), [Cybersecurity]() Tags: [announce](), [chainguard](), [chainguard-images](), [cisa](), [container-images](), [cybersecurity](), [fedramp](), [government](), [nist](), [product-security](), [provenance](), [secure-software](), [software-supply-chain-security](), [standards](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview Chainguard announces that it has signed CISA's Secure Software Development Attestation Form. The attestation states that Chainguard products align with NIST's Secure Software Development Framework and federal software supply chain security requirements, including secure development environments, trusted source code supply chains, automated controls, and provenance data. ### Source excerpt Chainguard has recently signed CISA's Secure Software Development Attestation Form, attesting to the security of Chainguard and its products. ## Day in the life of a food giant CISO DevFeed: [Day in the life of a food giant CISO]() Original publisher: [Read original article]() Author: Vandana Verma Sehgal Published: 2024-04-18T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Cybersecurity](), [Application Security](), [cloud-infrastructure](), [engineering-culture](), [Architecture & Design]() Tags: [application-security](), [awareness](), [blog](), [ciso](), [cloud](), [compliance](), [devrel](), [devsecops](), [executive](), [governance](), [leadership](), [management](), [organizational](), [product-security](), [security](), [security-engineering](), [strategy]() ### AI overview This developer-focused interview profiles Sherif Mansour, Just Eat's Director of Information Security, and discusses his career, Just Eat's three-line information security model, and his responsibilities across platform security, cloud and infrastructure, product security, application security, security engineering, culture, and awareness. It also describes organizational leadership principles and a themed weekly schedule for managing priorities. ### Source excerpt Snyk's Vandana Verma Sehgal sat down with Sherif Mansour, the Director of InfoSec at JustEat, for a "Day in the life of a CISO" session to learn more about his day-to-day experience as a security leader. ## Kroger's approach to supply chain security DevFeed: [Kroger's approach to supply chain security]() Original publisher: [Read original article]() Author: Brian Piper Published: 2024-01-02T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [supply-chain-security](), [open-source-security](), [snyk-code](), [snyk-platform](), [Application Security](), [DevOps](), [sdlc](), [Vulnerabilities]() Tags: [application-security](), [awareness](), [blog](), [customer](), [customer-featured](), [dependencies](), [devops](), [executive](), [megawatt](), [product-security](), [security](), [shift-left](), [snyk](), [snyk-code](), [snyk-platform](), [software-development](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [workflow]() ### AI overview The article describes Kroger's approach to securing its large-scale digital software supply chain. Kroger uses a shift-left strategy and the Snyk platform to integrate security into development and deployment workflows, improve developer efficiency, and address risks from open source dependencies and vulnerabilities. ### Source excerpt Recently, Snyk hosted a wine tasting & customer discussion featuring David Imhoff, Product Security Leader at Kroger. The discussion focused on tackling the challenges of securing digital supply chains. ## FDA Releases Final Cybersecurity Guidance for Medical Devices DevFeed: [FDA Releases Final Cybersecurity Guidance for Medical Devices]() Original publisher: [Read original article]() Author: Adam Published: 2023-09-26T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Cybersecurity](), [Security](), [Architecture & Design](), [Security & Privacy]() Tags: [cybersecurity](), [medical-devices](), [product-security](), [sdl](), [security]() ### AI overview The FDA released final cybersecurity guidance for medical devices, replacing guidance that was nearly nine years old. The article says it is detailed and product-focused, and discusses its expected effects on medical device submissions, other regulatory guidance, and product liability litigation. ### Source excerpt The FDA has released their new guidance, which will be broadly impactful. ## Conway's Law and Software Security DevFeed: [Conway's Law and Software Security]() Original publisher: [Read original article]() Author: Adam Published: 2018-06-06T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design](), [Software]() Tags: [code](), [conway-s-law](), [developers](), [product-security](), [security](), [software]() ### AI overview The article discusses how Conway's Law relates organizational structure to software security. It cites Steve Lipner's account of shifting responsibility from a small security engineering group to a much larger population of software engineers tasked with creating secure code. ### Source excerpt [no description provided] ## Browser URL Bars Can Fail as a Security Measure Against Punycode Phishing DevFeed: [Browser URL Bars Can Fail as a Security Measure Against Punycode Phishing]() Original publisher: [Read original article]() Author: Adam Published: 2017-04-17T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [browsers](), [Firefox]() Tags: [browsers](), [firefox](), [phishing](), [product-security](), [security]() ### AI overview The article argues that end users are not necessarily the weakest link in security when browsers make URL-based security checks difficult. It uses Punycode domains that can appear similar to trusted sites as an example and calls on browser makers to make URL-bar security measures resistant to attack. ### Source excerpt [no description provided]