# secrel Published articles for secrel. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## I Read Cursor's Security Agent Prompts, So You Don't Have To DevFeed: [I Read Cursor's Security Agent Prompts, So You Don't Have To]() Original publisher: [Read original article]() Author: Randall Degges Published: 2026-03-17T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cursor](), [Securing AI](), [ai security](), [Vulnerabilities](), [MCP Server](), [Orchestration](), [Prompt Engineering](), [Terraform](), [Persistence](), [Architecture & Design]() Tags: [agent](), [agentic](), [agents](), [ai](), [ai-security](), [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [cursor](), [developer](), [devops](), [executive](), [infrastructure](), [interest](), [mcp](), [mcp-server](), [orchestration](), [persistence](), [related-content](), [review](), [sbom](), [scm](), [secrel](), [secrets](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [terraform](), [vs-code](), [vulnerabilities]() ### AI overview The article examines Cursor's security review automation, which uses four autonomous agents to review more than 3,000 pull requests weekly, identify more than 200 vulnerabilities, and open fix pull requests. It argues that the concise prompts are only one part of the system; the larger achievement is the production infrastructure supporting persistence, deduplication, deployment, webhook orchestration, and state management. ### Source excerpt Cursor built AI security agents that review 3,000+ PRs weekly and catch 200+ vulnerabilities. Here's what they get right--and what's missing for enterprise security. ## 280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII DevFeed: [280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII]() Original publisher: [Read original article]() Author: Luca Beurer-Kellner; Aleksei Kudrinskii; Marco Milanta; Kristian Bonde Nielsen; Hemang Sarkar; Liran Tal Published: 2026-02-05T18:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Agent Skills](), [OpenClaw](), [AI Agent](), [API keys](), [Large Language Model](), [pii](), [Security](), [vulnerability]() Tags: [ai](), [ai-agent](), [api-keys](), [application-security](), [awareness](), [blog](), [developer](), [devrel](), [interest](), [openclaw](), [pii](), [secrel](), [secrets](), [security](), [skills](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk reports that 283 of 3,984 skills in the ClawHub marketplace, or 7.1%, contain critical flaws that expose API keys, passwords, credit card numbers, and other sensitive information through LLM context and plaintext logs. The article explains how OpenClaw agent skills can instruct agents to mishandle secrets and describes a credential-leaking email skill as an example. ### Source excerpt Discover how 7.1% of AI agent skills are designed to leak secrets, PII, and API keys through LLM context. Learn to defend with Evo & mcp-scan. ## Dive into AI and LLM learning with the new Snyk Learn learning path DevFeed: [Dive into AI and LLM learning with the new Snyk Learn learning path]() Original publisher: [Read original article]() Author: Michael Biocchi Published: 2024-09-18T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-learn](), [LLM security](), [ai security](), [Vulnerabilities](), [prompt injection](), [genai]() Tags: [ai](), [ai-security](), [awareness](), [blog](), [developer](), [devops](), [devrel](), [devsecops](), [engineering](), [free](), [llm-security](), [prompt-injection](), [secrel](), [security](), [snyk-learn](), [vulnerabilities]() ### AI overview Snyk Learn introduces a free learning path covering the OWASP Top 10 for LLMs and generative AI. It teaches developers and security professionals about risks such as prompt injection and sensitive information disclosure in AI-driven applications. ### Source excerpt Dive into the world of AI and LLM security with Snyk Learn's new free learning path. Learn how to protect your AI systems from the OWASP Top 10 vulnerabilities. Master prompt injection, sensitive data disclosure, and more. Start your AI security journey today! ## Vulnerabilities in NodeJS C/C++ add-on extensions DevFeed: [Vulnerabilities in NodeJS C/C++ add-on extensions]() Original publisher: [Read original article]() Author: Alessio Della Libera Published: 2024-08-14T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [C++](), [Application Security]() Tags: [add-ons](), [awareness](), [blog](), [c-c-plus-plus](), [code-security](), [developer](), [devrel](), [extensions](), [interest](), [javascript](), [npm-packages](), [open-source-security](), [secrel](), [security](), [security-labs](), [snyk-code](), [snyk-open-source](), [vulnerabilities]() ### AI overview An overview of security vulnerabilities and vulnerable patterns in NodeJS C/C++ add-ons, with remediation guidance for open-source maintainers. ### Source excerpt In this blog post, we aim to provide an overview of common security vulnerabilities and vulnerable patterns that can occur when writing C/C++ add-ons in NodeJS. ## AppSec Maturity Models DevFeed: [AppSec Maturity Models]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2024-03-08T00:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Security](), [Development](), [sdlc](), [Test coverage]() Tags: [application-security](), [article](), [awareness](), [compliance](), [how-to](), [learn](), [measurement](), [megawatt](), [metrics](), [reports](), [sdlc](), [secrel](), [security](), [standard]() ### AI overview This article explains how application security maturity models help organizations assess their current security posture, define goals, track progress with concrete metrics, and support continuous improvement. It covers their benefits for establishing standards, tailoring security efforts, building an AppSec program across the application library and SDLC, identifying improvement opportunities, generating reports, and demonstrating compliance. ### Source excerpt Learn what to include in your application security maturity model and how to assess your current level of application security maturity. ## New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends DevFeed: [New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends]() Original publisher: [Read original article]() Author: Micah Silverman Published: 2024-01-18T20:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Application Security](), [snyk-apprisk](), [.env](), [passwords](), [ai security](), [Cryptography](), [Quantum Computing]() Tags: [ai](), [ai-security](), [application-security](), [aspm](), [blog](), [ci-cd](), [devrel](), [encryption](), [env-file-security](), [passwords](), [quantum-computing](), [secrel](), [secrets](), [security](), [snyk](), [snyk-platform](), [snyk-team]() ### AI overview Snyk DevRel, SecRel, and industry security experts share personal and professional security resolutions for 2024. The recommendations cover password-vault hygiene, two-factor authentication, application security, secrets management, automated CI/CD scanning, responsible AI use, AI security training, privacy and ethics, encryption, and awareness of quantum computing. ### Source excerpt This year, we asked the DevRel and SecRel team at Snyk and security experts from around the industry to drop in their personal and professional New Year's security resolutions for 2024. ## How to integrate ASPM with your application security program DevFeed: [How to integrate ASPM with your application security program]() Original publisher: [Read original article]() Author: Vandana Verma Sehgal Published: 2023-11-28T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [dashboards](), [Development](), [Vulnerabilities]() Tags: [application-security](), [aspm](), [awareness](), [blog](), [developer](), [devops](), [devrel](), [lifecycle](), [management](), [monitor](), [secrel](), [security](), [snyk-platform](), [software-development](), [visibility](), [vulnerabilities]() ### AI overview This article introduces application security posture management (ASPM), explaining how it helps AppSec teams continuously monitor, manage, and improve application security throughout the software lifecycle. It describes ASPM's unified dashboard, lifecycle visibility, security-data consolidation, resource prioritization, and governance of application-specific security controls and policies. ### Source excerpt In this blog, we'll review the key concepts of application security posture management and walkthrough how ASPM fits into your application security lifecycle and makes your organization more secure. ## What's new in CVSS 4.0 DevFeed: [What's new in CVSS 4.0]() Original publisher: [Read original article]() Author: Paul Lascar Published: 2023-11-08T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [Cybersecurity](), [Security](), [Architecture & Design](), [Open Source]() Tags: [application-security](), [awareness](), [blog](), [blog-post](), [code-security](), [comparison](), [cybersecurity](), [devops](), [devrel](), [open-source](), [secrel](), [security](), [snyk](), [technical](), [vulnerabilities](), [vulnerability]() ### AI overview Snyk examines CVSS 4.0, released on November 1, 2023, and compares it technically with CVSS 3.1. The article describes the revised vulnerability-scoring framework's goal of providing greater granularity for evolving cybersecurity threats, including changes to Attack Vector and the division of Attack Complexity into Attack Complexity and Attack Requirements. ### Source excerpt In this blog post, we will highlight Snyk's view on the new vulnerability scoring framework, CVSS 4.0, which was released on November 1, 2023. ## High severity vulnerability found in libcurl and curl (CVE-2023-38545) DevFeed: [High severity vulnerability found in libcurl and curl (CVE-2023-38545)]() Original publisher: [Read original article]() Author: Hadas Bloom; Tal Dromi; Micah Silverman Published: 2023-10-04T23:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities]() Tags: [acquisition](), [announcement](), [blog](), [devrel](), [pmm](), [secrel](), [security](), [snyk-open-source](), [vulnerability](), [vulnerability-insights]() ### AI overview Reports CVE-2023-38545, a high-severity heap-based buffer overflow in libcurl and curl, and identifies affected versions and the 8.4.0 fix. ### Source excerpt In this pre-announcement of a new High severity curl vulnerability, learn how to gauge the potential impact to your organization and get steps to prepare for the forthcoming patch. ## Critical WebP 0-day security CVE-2023-4863 impacts wider software ecosystem DevFeed: [Critical WebP 0-day security CVE-2023-4863 impacts wider software ecosystem]() Original publisher: [Read original article]() Author: Brian Clark; Eric Smalling; Jonathan Moses Published: 2023-09-28T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Vulnerabilities](), [Electron](), [browsers](), [supply-chain-security](), [Chrome](), [container images](), [FFmpeg (Fast Forward Moving Picture Experts Group)]() Tags: [awareness](), [blog](), [chrome](), [container-images](), [container-security](), [cve](), [devrel](), [docker](), [electron](), [executive](), [ffmpeg](), [open-source-security](), [secrel](), [security](), [snyk-container](), [snyk-open-source](), [snyk-security-intel](), [software-supply-chain](), [supply-chain](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview This article examines the critical WebP library vulnerability CVE-2023-4863, which could be exploited through maliciously formed images. The issue affects Chrome, Chrome-powered applications, operating systems, application frameworks such as Electron, and software including Pillow, FFmpeg, and Gimp. Versions 0.5.0 through 1.3.1 are affected, and upgrading to at least version 1.3.2 is recommended. The article also highlights the vulnerability's broader software supply chain impact and the importance of scanning applications and container images. ### Source excerpt CVE-2023-4863 vulnerability identified in the WebP library libwebp extends to more than just browsers - Learn how to find and fix this critical vulnerability with Snyk ## CodeSecDays conference and more complete security coverage with GitGuardian DevFeed: [CodeSecDays conference and more complete security coverage with GitGuardian]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-08-10T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [supply-chain-security](), [open-source-security](), [Secrets Management](), [Tooling]() Tags: [acquisition](), [awareness](), [blog](), [ci-cd](), [developer](), [devops](), [gitguardian](), [pmm](), [related-content](), [secrel](), [secrets-management](), [security](), [snyk](), [snyk-platform](), [software-supply-chain-security](), [supply-chain-security](), [vulnerabilities]() ### AI overview Snyk describes its partnership with GitGuardian and its participation in the CodeSecDays digital conference. The article summarizes panel guidance on reducing silos between development and security teams, integrating security tooling into workflows, training developers, and improving software supply chain security incrementally. ### Source excerpt Snyk partners with GitGuardian to offer more complete security coverage and speaks at the company's new digital CodeSecDays conference.