# Secure by design Published articles for Secure by design. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How Webflow builds security into your site DevFeed: [How Webflow builds security into your site]() Original publisher: [Read original article]() Author: Ty Sbano Published: 2026-10-26T00:00:00Z Content type: article Language: en Sources: [Webflow Blog]() Topics: [Security](), [webflow](), [Security Information and Event Management (SIEM)]() Tags: [2fa](), [access-control](), [account](), [account-protection](), [ai](), [ai-governance](), [amazon-web-services-aws](), [api](), [availability](), [builds](), [ccpa](), [cdn](), [certificate](), [certificates](), [changes](), [cloudflare](), [secure-by-design](), [security](), [web-platform](), [webflow]() ### AI overview Webflow describes a layered security model spanning independently audited controls, hosting protections, account safeguards, and enterprise governance. It lists SOC 1 and SOC 2 Type 2 reports, several ISO certifications, annual penetration testing, and a vulnerability disclosure program, with reports available through its Trust Center. All plans include DDoS protection and rate limiting, Cloudflare CDN, TLS 1.2+, automatic SSL, encryption at rest, default HSTS, automated patching, version history, and one-click restore. Enterprise adds options such as custom certificates and headers, private staging, SSO/SCIM, role-based access, approval workflows, and audit logs. The article contrasts Webflow's built-in core functions with WordPress's reliance on third-party plugins, whose updates and security practices depend on their developers. It also describes 2FA, password-protected sites or pages, automatic backups, and Webflow's process for assessing, communicating, and patching vulnerabilities. These are Webflow's stated features and practices; the excerpt does not provide comparative independent performance results. ### Source excerpt You can't defend your site from all possible security risks on your own. You need a web platform that is secure by design and scaled with ease. ## How Webflow builds security into your site DevFeed: [How Webflow builds security into your site]() Original publisher: [Read original article]() Author: Ty Sbano Published: 2026-10-26T00:00:00Z Content type: article Language: en Sources: [Webflow Blog]() Topics: [Security](), [webflow](), [Security Information and Event Management (SIEM)](), [Cloudflare]() Tags: [access-control](), [account](), [account-protection](), [admin](), [advanced](), [agentic](), [ai](), [ai-governance](), [api](), [app](), [apps](), [assets](), [attacks](), [audit](), [secure-by-design](), [security](), [security-risks](), [site](), [web-platform](), [webflow]() ### AI overview Webflow describes a security model combining independently audited controls, managed hosting protections, account safeguards, and added enterprise governance. It reports SOC 1 and SOC 2 Type 2 reports, several ISO certifications, annual third-party penetration testing, and a vulnerability disclosure program; security teams can request reports through its Trust Center. All plans include DDoS protection and rate limiting, Cloudflare CDN, TLS 1.2+ and encryption at rest, automatic SSL, default HSTS, automated patching, version history, and restore. Webflow says core site functions are integrated, reducing reliance on third-party plugins that require separate security upkeep. Users can enable 2FA, password-protect sites or pages, and use automatic and manual backups. Enterprise adds SSO/SCIM, JIT provisioning, custom roles and RBAC, publishing approvals, private staging, and configurable security settings. Activity and audit logs capture site changes and access-governance events for review or SIEM export. The article says Webflow tracks reported vulnerabilities, assesses impact, communicates through its Trust Center, and patches affected systems. ### Source excerpt You can't defend your site from all possible security risks on your own. You need a web platform that is secure by design and scaled with ease. ## Secure by Design: How to Engineer Security into Architecture Before Writing Any Code DevFeed: [Secure by Design: How to Engineer Security into Architecture Before Writing Any Code]() Original publisher: [Read original article]() Author: Oluwaseyi Fatunmole Published: 2026-10-15T05:00:08Z Content type: tutorial Language: en Sources: [Free Code Camp]() Topics: [Application Security](), [CI/CD](), [engineering-culture]() Tags: [apisecurity](), [design](), [engineering](), [how-to](), [owasp-top-10](), [secure-by-design](), [security](), [securityawareness](), [system-design]() ### AI overview A practical guide to engineering security into software from the design stage. It covers threat modeling, enforcing security rules in the domain layer, encryption and database safeguards, secure logging, CI/CD security checks, microservice communication, and privacy requirements. The article argues that security should be treated as an engineering responsibility and built into architecture before implementation. ### Source excerpt There's a conversation that happens in most engineering teams,maybe usually too late. Think of this, a feature ships to production. A security review happens afterwards, or a penetration test finds so ## The Cyber Resilience Act Raises Security Expectations for Open Source Software DevFeed: [The Cyber Resilience Act Raises Security Expectations for Open Source Software]() Original publisher: [Read original article]() Author: Roman Zhukov Published: 2026-10-09T00:00:00Z Content type: article Language: en Sources: [Red Hat Blog]() Topics: [open-source-security](), [cyber resilience act](), [open source maintenance](), [openssf]() Tags: [compliance](), [open-source](), [regulatory](), [secure-by-design](), [software]() ### AI overview The article explains how the EU Cyber Resilience Act affects companies that sell software or hardware in Europe and raises security expectations for open source projects used in commercial products. It outlines steps such as tracking dependencies and vulnerabilities, coordinating with upstream maintainers, and adopting documented security practices. It also describes Red Hat's role in supporting projects including Ansible and Fedora. ### Source excerpt Open source software faces significant regulatory shifts, making "secure by design" development practices increasingly important. The Cyber Resilience Act (CRA) takes effect on December 11, 2027, and as of September 11, 2026, the first CRA vulnerability and incident reporting obligations were live. These new cybersecurity regulations impact all companies that sell software or hardware to the European market and will have a huge impact on open source as a whole.The readiness gap and the cost of inactionDespite the looming deadline, the software industry remains unprepared. According to The Linu ## What's in the SOSS? Podcast #71 - S3E23 Navigating the New Era: The EU Cyber Resilience Act Explained with Madalin Neag DevFeed: [What's in the SOSS? Podcast #71 - S3E23 Navigating the New Era: The EU Cyber Resilience Act Explained with Madalin Neag]() Original publisher: [Read original article]() Author: OpenSSF Published: 2026-09-01T13:16:32Z Content type: article Language: en Sources: [Open Source Security Foundation]() Topics: [cyber resilience act](), [Open Source](), [supply-chain-security](), [Maintainers](), [open-source-security](), [Cybersecurity]() Tags: [cra-readiness](), [cyber-resilience-act](), [cybersecurity](), [eu-cyber-resilience-act](), [eu-policy](), [maintainers](), [open-source](), [open-source-security](), [openssf](), [podcast](), [secure-by-design](), [software-supply-chain]() ### AI overview This podcast episode explains the EU Cyber Resilience Act, including its cybersecurity baseline for digital products, implications for open source maintainers and software stewards, and the relationship between compliance, engineering practices, and the global software supply chain. ### Source excerpt In this episode of What's in the SOSS, host Sally Cooper and OpenSSF EU Policy Advisor Madalin Neag demystify the EU Cyber Resilience Act (CRA). Learn how the CRA establishes a new cybersecurity baseline and what it means for open source maintainers, contributors, and the global software supply chain. ## AAOS SDV - Secure by Design DevFeed: [AAOS SDV - Secure by Design]() Original publisher: [Read original article]() Author: István Nádor Published: 2026-08-24T00:00:00Z Content type: article Language: en Sources: [Android Developers]() Topics: [Application Security](), [virtualization](), [Cryptography](), [virtual machines](), [SELinux]() Tags: [access-control](), [attack](), [attestation](), [authentication](), [automotive](), [boot](), [certificates](), [product-news](), [secure-by-design](), [software](), [virtualization]() ### AI overview The article describes security measures in Android Automotive OS for Software Defined Vehicles, including virtual machines for domain isolation, Android security controls, signed and verified software delivery, Rust development, and DICE-based authentication for communication across vehicle domains. ### Source excerpt At Google, we believe our products should be secure by design, which is why we built the Android Automotive Operating System for Software Defined Vehicle (AAOS SDV) on existing, market-proven platforms, leveraging virtualization technologies like Cuttlefish. ## Checkmarx One for Government Achieves FedRAMP Moderate Certification DevFeed: [Checkmarx One for Government Achieves FedRAMP Moderate Certification]() Original publisher: [Read original article]() Author: Kevin Hayes Published: 2026-07-26T06:24:46Z Content type: release Language: en Sources: [Checkmarx]() Topics: [Application Security](), [Security](), [Vulnerabilities](), [malicious packages](), [Open Source](), [Access Control]() Tags: [agentic-ai](), [ai-generated-code](), [application-security](), [appsec](), [blog](), [checkmarx](), [checkmarx-one](), [checkmarx-product-news-use-cases-guides](), [dependencies](), [federal-government](), [fedramp](), [fedramp-moderate-certification](), [government](), [malicious-packages](), [modules](), [open-source](), [public-sector](), [secure-by-design](), [security](), [us-government]() ### AI overview Checkmarx One for Government has achieved FedRAMP Moderate certification, giving U.S. government agencies a compliant application security platform for sensitive unclassified workloads. The article explains the certification's security-control requirements and the risks posed by vulnerabilities, open-source libraries, and malicious packages. ### Source excerpt A new standard for secure-by-design in the public sector. ## Why the CVE doom cycle cannot be solved by working harder DevFeed: [Why the CVE doom cycle cannot be solved by working harder]() Original publisher: [Read original article]() Author: Sam Barlien Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [vulnerability management](), [Automation](), [container-security](), [Vulnerabilities](), [configuration]() Tags: [automation](), [container-image-security](), [cve](), [false-positives](), [secure-by-design](), [security](), [vulnerability-management]() ### AI overview The article argues that the recurring cycle of scanning, triaging, patching, and redeploying container images cannot be solved by working harder or using faster scanners. Because vulnerability findings and CVEs accumulate faster than manual remediation can handle, it recommends embedding vulnerability management into the platform through secure-by-design practices, golden paths, and automation. ### Source excerpt Manual CVE triage doesn't scale. Break the CVE doom cycle by shifting vulnerability management into the platform with golden paths and automation ## How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate DevFeed: [How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate]() Original publisher: [Read original article]() Author: info@goteleport.com (Maximilian Heck, Waldemar Kindler) Published: 2026-07-16T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cyber resilience act](), [Security](), [software-architecture](), [Authentication](), [Encryption](), [audit trail](), [Monitoring & Alerting]() Tags: [audit-trail](), [authentication](), [compliance](), [cra-requirements](), [cryptographic](), [cyber-resilience-act](), [eu](), [monitoring-alerting](), [secure-by-design](), [security]() ### AI overview The article explains how Teleport maps its infrastructure identity, access, policy, logging, monitoring, and audit controls to ENISA's Secure by Design and Default Playbook and the EU Cyber Resilience Act. It highlights cryptographic identity, least privilege, secure communication, supply-chain controls, and default protection of device identities and secrets. ### Source excerpt See how Teleport features map to ENISA's Secure-by-Design specification for CRA. ## Why IaC Coverage Belongs on Your Security Dashboard DevFeed: [Why IaC Coverage Belongs on Your Security Dashboard]() Original publisher: [Read original article]() Author: Gilad Berenblut Published: 2026-07-13T12:34:03Z Content type: article Language: en Sources: [Wiz]() Topics: [Infrastructure as code](), [Security](), [cloud-infrastructure](), [cloud security](), [dashboards](), [DevOps](), [policy-as-code]() Tags: [cloud-infrastructure](), [cloud-security](), [dashboard](), [devops](), [iac](), [infrastructure](), [policy-as-code](), [product-company-news](), [secure-by-design](), [security](), [wiz-cloud](), [wiz-code](), [wiz-platform]() ### AI overview The article proposes measuring Infrastructure-as-Code coverage as a security dashboard metric. It presents coverage as a funnel showing which cloud resources are supportable by IaC, tracked by an IaC tool, and declared in a repository, helping security and DevOps teams identify governance and remediation gaps. ### Source excerpt Rethinking IaC coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed ## CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) DevFeed: [CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)]() Original publisher: [Read original article]() Author: Aliz Hammond Published: 2026-06-30T19:35:58Z Content type: article Language: en Sources: [watchTowr Labs]() Topics: [Vulnerabilities]() Tags: [2026](), [cve](), [memory](), [secure-by-design](), [vulnerabilities](), [zero-day]() ### AI overview The article discusses a newly disclosed Citrix NetScaler pre-auth memory disclosure vulnerability, CVE-2026-8451, and places it within the broader CitrixBleed class of memory-related vulnerabilities. It argues that repeated findings suggest fragile memory management in Citrix NetScaler appliances. ### Source excerpt Well, well, well - once again, the cat has dragged us in and spat us out. Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? "But watchTowr, what do you mean?" Well, if you're here, you likely fit ## Ivanti Sentry Pre-Auth OS Command Injection and Authentication Bypass Vulnerabilities DevFeed: [Ivanti Sentry Pre-Auth OS Command Injection and Authentication Bypass Vulnerabilities]() Original publisher: [Read original article]() Author: Sonny Published: 2026-06-10T00:52:20Z Content type: article Language: en Sources: [watchTowr Labs]() Topics: [Vulnerabilities](), [Exploit](), [Authentication](), [gateway](), [Server]() Tags: [authentication](), [authentication-bypass](), [cve](), [cvss-score](), [gateway](), [ivanti](), [remote-code-execution](), [secure-by-design](), [vulnerabilities]() ### AI overview The article examines two vulnerabilities in Ivanti Sentry: a pre-authentication OS command injection flaw enabling remote root-level code execution and an authentication bypass allowing attackers to create administrative accounts. It also describes Sentry's role as a gateway between mobile devices and enterprise systems. ### Source excerpt Today, Ivanti published an advisory. "No way?" we hear you say. "Yes way!" Today's advisory outlines two vulnerabilities in Ivanti's Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities. CVE-2026-10520 An OS Command Injection ## The Agile FedRAMP Playbook, Part 3: Preventative Risk Management by building Secure by Design DevFeed: [The Agile FedRAMP Playbook, Part 3: Preventative Risk Management by building Secure by Design]() Original publisher: [Read original article]() Author: Bryan Rosensteel Published: 2026-02-27T15:33:55Z Content type: article Language: en Sources: [Wiz]() Topics: [risk-management](), [Security](), [sdlc](), [Agile](), [iac-security](), [FedRAMP Rev 5]() Tags: [agile-development](), [fedramp-rev-5](), [public-sector](), [requirements](), [risk](), [risk-management](), [secure-by-design](), [security]() ### AI overview The third installment of Wiz's Agile FedRAMP Playbook explains preventative risk management through secure-by-design practices. It describes shifting security checks earlier in the software development lifecycle to reduce vulnerabilities and misconfigurations entering production while supporting FedRAMP authorization. ### Source excerpt In the third part of our series, we explore Preventative Risk Management. We discuss how shifting security into the development lifecycle helps organizations meet FedRAMP requirements. ## The Agile FedRAMP Playbook, Part 1: Why Risk is Your Best Starting Point DevFeed: [The Agile FedRAMP Playbook, Part 1: Why Risk is Your Best Starting Point]() Original publisher: [Read original article]() Author: Bryan Rosensteel Published: 2026-02-13T12:00:01Z Content type: opinion Language: en Sources: [Wiz]() Topics: [risk-management](), [Security](), [Cloud](), [Vulnerabilities](), [Automation](), [Agile]() Tags: [agile](), [automation](), [cloud](), [compliance](), [fedramp](), [public-sector](), [risk](), [risk-management](), [secure-by-design](), [security]() ### AI overview The first part of Wiz's Agile FedRAMP Playbook presents a risk-first approach to achieving FedRAMP High authorization. It argues that prioritizing real-world security risks, supported by automation and secure-by-design practices, can help organizations maintain innovation while meeting rigorous federal requirements. ### Source excerpt Compliance shouldn't mean a standstill for innovation. The first of our four-part series explores how Wiz quickly reached FedRAMP High through a "risk-first" philosophy. In parts 2-4 we'll explore how Wiz helps with FedRAMP requirements through proactive, preventative, and reactive risk management. ## Start Safe, Stay Secure: How Anchore and Chainguard Libraries Strengthen Software Supply Chains DevFeed: [Start Safe, Stay Secure: How Anchore and Chainguard Libraries Strengthen Software Supply Chains]() Original publisher: [Read original article]() Author: Jono Bergquist Published: 2025-12-04T17:00:00Z Content type: release Language: en Sources: [Anchore]() Topics: [supply-chain-security](), [chainguard libraries](), [cve remediation](), [anchore](), [DevSecOps](), [Security]() Tags: [blog](), [cve-remediation](), [dependencies](), [devsecops](), [malware](), [secure-by-design](), [software-development]() ### AI overview Anchore and Chainguard are expanding their partnership through an integration between Anchore Enterprise and Chainguard Libraries for Python. The integration lets customers validate remediated CVEs in existing scanning workflows, reducing software supply chain risk and unnecessary triage. ### Source excerpt The post Start Safe, Stay Secure: How Anchore and Chainguard Libraries Strengthen Software Supply Chains appeared first on Anchore.Using DevSecOps principles to approach software development is always the ideal. We love "secure by design" at Anchore but...unfortunately there are limits to how far this practice can stretch before it breaks. The messy reality of user needs and operational constraints often forces organizations to veer off the "golden path" paved by the best intentions [...] ## Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing DevFeed: [Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing]() Original publisher: [Read original article]() Author: Edward Fernandez (noreply@blogger.com) Published: 2025-11-20T17:00:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [Android Security](), [Cryptography](), [Android](), [google play protect]() Tags: [android](), [android-security](), [cross-platform](), [file-sharing](), [interoperability](), [modeling](), [none](), [penetration](), [penetration-testing](), [platform](), [privacy](), [quick-share](), [risks](), [secure-by-design](), [security](), [security-and-privacy](), [security-standards]() ### AI overview Quick Share can exchange files both ways with AirDrop on the Pixel 10 family, using a direct peer-to-peer connection. It currently requires AirDrop's "Everyone for 10 minutes" mode; recipients must approve files, and users can confirm the other device's name in person. Google says it built the interoperability layer in Rust, citing memory-safety protections against bugs in parsing malformed wireless data, alongside Android and iOS platform safeguards. Its development included threat modeling, privacy and security reviews, internal penetration testing, and an independent NetSPI assessment, which Google reports found the implementation secure, "notably stronger" than other industry implementations, and without information leaks. Google describes Contacts Only support and broader device availability as future goals. ### Source excerpt Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google Technology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That's why Android has been building experiences that help you stay connected across platforms. As part of our efforts to continue to make cross-platform communication more seamless for users, we've made Quick Share interoperable with AirDrop, allowing for two-way file sharing between Android and iOS devices, starting with the Pixel 10 Family. This new feature makes it possible to quickly share your photos, videos, and files with people you choose to communicate with, without worrying about the kind of phone they use. Most importantly, when you share personal files and content, you need to trust that it stays secure. You can share across devices with confidence knowing we built this feature with security at its core, protecting your data with strong safeguards that have been tested by independent security experts. Secure by Design We built Quick Share's interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products. Our approach to security is proactive and deeply integrated into every stage of the development process. This includes: Threat Modeling: We identify and address potential security risks before they can become a problem. Internal Security Design and Privacy Reviews: Our dedicated security and privacy teams thoroughly review the design to ensure it meets our high standards. Internal Penetration Testing: We conduct extensive in-house testing to identify and fix vulnerabilities. This Secure by Design philosophy ensures that all of our products are not just functional but also fundamentally secure. This feature is also protected by a multi-layered security approach to ensure a safe sharing experience from end-to-end, regardless of what platform you're on. Secure S ## Introducing New Updates to the Chainguard Images Directory DevFeed: [Introducing New Updates to the Chainguard Images Directory]() Original publisher: [Read original article]() Published: 2025-11-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard images](), [container images](), [container](), [Kubernetes](), [Deployment](), [Open Source]() Tags: [bitnami-helm-charts](), [chainguard](), [chainguard-catalog](), [chainguard-console](), [chainguard-containers](), [chainguard-helm-charts](), [chainguard-images](), [chainguard-images-directory](), [compare](), [container-images](), [containers](), [cost](), [cve](), [demo](), [deployment](), [helm](), [helm-charts](), [kubernetes](), [oci](), [registry](), [secure-by-design](), [updates](), [zero-cve-containers]() ### AI overview Chainguard has updated its Images Directory with an embedded ROI calculator, Helm Charts for Kubernetes deployments, and refreshed data about the Chainguard Factory. The calculator compares CVE counts and remediation costs, while the Helm Charts provide drop-in replacements for popular open source applications using Chainguard Containers and OCI delivery. ### Source excerpt We've improved the Chainguard Images Directory with Helm charts for faster deployments, an ROI calculator, and more refreshed data to improve your experience. ## Secure by Design: The Future of Threat Modeling for AI-Native Applications DevFeed: [Secure by Design: The Future of Threat Modeling for AI-Native Applications]() Original publisher: [Read original article]() Author: John Carione Published: 2025-11-11T05:00:00Z Content type: opinion Language: en Sources: [Snyk]() Topics: [Security](), [ai security](), [software-architecture](), [Artificial Intelligence](), [snyk](), [Vulnerabilities](), [prompt injection]() Tags: [agentic](), [ai](), [prompt-injection](), [secure-by-design](), [security](), [security-for-ai](), [snyk]() ### AI overview This Snyk article argues that traditional, manual threat modeling cannot keep pace with AI-native applications built from large language models, autonomous agents, APIs, and changing data flows. It presents continuous, automated, AI-assisted threat modeling as a way to maintain secure-by-design systems and address risks such as prompt injection, data exfiltration, data poisoning, and agentic vulnerabilities. ### Source excerpt Explore how Snyk's Evo Threat Modeling Agent automates and contextualizes security for AI-native applications, addressing prompt injection, data exfiltration, data poisoning, and agentic vulnerabilities. ## Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk DevFeed: [Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-08-07T04:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [snyk](), [ai security](), [AI Strategy](), [AI Development](), [Security](), [Vulnerabilities](), [AI Platform](), [GitHub](), [Terraform]() Tags: [agentic-ai-security](), [ai](), [ai-adoption](), [ai-infrastructure](), [ai-security](), [awareness](), [blog](), [compliance](), [devops](), [executive](), [github](), [government](), [nist](), [sboms](), [secure-by-design](), [security](), [self-hosted](), [snyk](), [snyk-platform](), [terraform](), [vulnerabilities]() ### AI overview This article explains how Snyk for Government helps federal agencies adopt AI securely through secure-by-design development, continuous vulnerability management, compliance support, automation, and governance. It highlights integrations across developer workflows, FedRAMP authorization, standards-aligned practices, and the Snyk AI Trust Platform. ### Source excerpt Learn how Snyk for Government helps federal agencies meet AI mandates with confidence. Snyk's AI Trust Platform ensures secure-by-design development, compliance, and transparent AI systems. ## From Ideas to Impact: How the Bay Area Is Shaping the Future of Secure AI DevFeed: [From Ideas to Impact: How the Bay Area Is Shaping the Future of Secure AI]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2025-08-06T04:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [Artificial Intelligence](), [Trustworthy AI](), [ai security](), [Generative AI](), [Model Context Protocol](), [Responsibility & Safety](), [cursor](), [CI/CD](), [sdlc](), [software-development](), [AWS Transform]() Tags: [agentic-ai](), [agents](), [ai](), [ai-security](), [application-security](), [awareness](), [blog](), [ci-cd](), [compliance](), [cursor](), [development](), [devsecops](), [executive](), [mcp-server](), [sdlc](), [secure-by-design](), [security](), [snyk-platform](), [trust](), [updates]() ### AI overview This article reports insights from Snyk's Silicon Valley Lighthouse event on building secure, trustworthy AI systems. It examines agentic applications, evolving development workflows, real-time security feedback, and a culture of shared responsibility across development, platform, and security teams. ### Source excerpt Insights from Snyk's Silicon Valley Lighthouse event on building secure, trustworthy AI. Learn how to secure agentic apps, embrace a "secure by everyone" culture, and use guardrails for AI innovation. ## Guarding Azure Functions: Serverless Meets Secure-by-Design Containers DevFeed: [Guarding Azure Functions: Serverless Meets Secure-by-Design Containers]() Original publisher: [Read original article]() Published: 2025-07-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [azure functions](), [chainguard images](), [azure container apps](), [Serverless](), [container images](), [Node.js](), [Security](), [event driven](), [Cloud]() Tags: [azure](), [azure-functions](), [chainguard-containers](), [cloud](), [container-images](), [event-driven](), [node-js](), [safe-source-for-open-source](), [secure-by-design](), [security](), [serverless]() ### AI overview The article presents Chainguard Containers for Azure Functions, combining serverless deployment with secure-by-design, traceable container images. It describes a customized Node.js base image containing the Azure Functions Host, Node.js Worker for Functions, compatibility support, and extension bundles. ### Source excerpt Chainguard Containers with Azure Functions offers the convenience of serverless and the confidence of a trusted, traceable image built for security. ## Understanding CRA Compliance: Overcoming Challenges with an Integrated Security Testing Approach DevFeed: [Understanding CRA Compliance: Overcoming Challenges with an Integrated Security Testing Approach]() Original publisher: [Read original article]() Author: Snyk Team Published: 2025-06-25T23:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [Security](), [Software Testing](), [vulnerability management](), [DevOps](), [Developer Tools](), [Vulnerabilities](), [software-development](), [Open Source]() Tags: [awareness](), [best-practices](), [blog](), [community](), [compliance](), [cra-requirements](), [cyber-resilience-act](), [cybersecurity](), [dependencies](), [deployment](), [developer](), [developers](), [development](), [devops](), [engineering](), [eu](), [scanners](), [secure-by-design](), [security](), [snyk-code](), [snyk-iac](), [snyk-learn](), [snyk-open-source](), [testing](), [vulnerabilities](), [vulnerability](), [vulnerability-management](), [workflows]() ### AI overview This article explains how the Cyber Resilience Act (CRA) changes software delivery expectations for organizations serving the EU. It highlights continuous security validation across proprietary code, open source libraries, and third-party dependencies, and recommends integrated security testing, secure-by-design practices, aligned teams, modern tooling, and security embedded in daily development workflows. ### Source excerpt Learn how to meet CRA requirements with integrated security testing, secure-by-design workflows, and scalable practices for modern dev teams. ## BYOC: Secure by design, proper controls by default DevFeed: [BYOC: Secure by design, proper controls by default]() Original publisher: [Read original article]() Author: Bipin Singh Published: 2025-06-18T00:00:00Z Content type: article Language: en Sources: [Redpanda]() Topics: [Security](), [Software as a service](), [Self-hosted](), [Amazon VPC](), [Cloud](), [identity and access management](), [Deployment](), [software-architecture]() Tags: [byoc-deployment](), [cloud-vpc-security](), [compliance-in-cloud-services](), [data-control-and-governance](), [data-streaming-security](), [deployment](), [iam](), [jpmc-software-suppliers-letter](), [product](), [redpanda-byoc](), [redpanda-cloud-features](), [saas](), [saas-operational-simplicity](), [secure-by-default](), [secure-by-design](), [secure-saas-solutions](), [security](), [self-hosted](), [self-hosted-vs-saas-security](), [streaming-data-compliance](), [vpc]() ### AI overview Redpanda argues that JPMorgan Chase's security requirements make secure-by-default design, continuous control validation, governance, and flexible deployment essential for enterprise software. Its Redpanda Cloud BYOC model places the data plane in the customer's VPC while Redpanda operates the control plane, preserving data ownership and operational convenience. ### Source excerpt JPMorgan Chase warns: no governance, no deal. Luckily, Redpanda BYOC provides the security of self-hosted with the convenience of SaaS. Read more. ## Trusted Container Images: A Better Way to Build and Deploy Software DevFeed: [Trusted Container Images: A Better Way to Build and Deploy Software]() Original publisher: [Read original article]() Published: 2025-06-11T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Docker Hardened Images](), [container](), [Security](), [chainguard images](), [Open Source]() Tags: [buyers-guide](), [chainguard-containers](), [chainguard-libraries](), [chainguard-vms](), [container-images](), [open-source-artifacts](), [secure-by-design](), [secure-container-images](), [secure-open-source-artifacts](), [security](), [supply-chain-security]() ### AI overview Chainguard's Buyer's Guide presents trusted container images and other open source artifacts as a way for enterprise engineering and security teams to reduce maintenance work, address supply-chain risks, and simplify compliance. It highlights Chainguard Containers as minimal, hardened images continuously built from source. ### Source excerpt Chainguard's Trusted Container Images and Open Source Artifacts Buyer's Guide helps you improve supply chain security and reduce costly engineering toil. [Next page]()