# secure software Published articles for secure software. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Understanding platform engineering's role in staying compliant with the EU's CRA DevFeed: [Understanding platform engineering's role in staying compliant with the EU's CRA]() Original publisher: [Read original article]() Author: Nigel Douglas Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Security](), [vulnerability management](), [supply-chain-security](), [incident]() Tags: [compliance](), [cyber-resilience-act](), [engineering](), [eu](), [idp](), [incident](), [platform](), [platform-engineering](), [policy](), [regulatory](), [sboms](), [secure-by-default](), [secure-software](), [security](), [software-supply-chain](), [supply-chain](), [vulnerabilities](), [vulnerability-management]() ### AI overview The article explains how platform engineering can operationalize compliance with the EU's Cyber Resilience Act by embedding secure-by-default practices, automated SBOMs, and rapid incident reporting into an Internal Development Platform. It also outlines CRA compliance milestones and manufacturer responsibilities, including vulnerability management and security updates. ### Source excerpt The EU's Cyber Resilience Act (CRA) mandates secure software by design. Discover how platform engineering operationalizes compliance by embedding secure-by-default standards, automated SBOMs, and rapid incident reporting into your Internal Development Platform (IDP). This approach transforms compliance into a frictionless golden path ## Why Backporting Python Security Fixes Is Complex and Risky DevFeed: [Why Backporting Python Security Fixes Is Complex and Risky]() Original publisher: [Read original article]() Published: 2026-02-27T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Python](), [Security](), [Vulnerabilities](), [chainguard libraries]() Tags: [chainguard-libraries](), [cve](), [dependency](), [machine-learning](), [python](), [python-dependencies](), [python-libraries](), [python-packages](), [secure-software](), [security](), [vulnerabilities](), [zero-cve-python-libraries]() ### AI overview The article explains why updating vulnerable Python dependencies can be difficult when compatibility constraints prevent immediate upgrades. It argues that manually backporting security patches is complex, time-consuming, and risky, and presents Chainguard Libraries as a source of tested and verified patched packages. ### Source excerpt Backporting Python CVE fixes is complex and risky. Chainguard Libraries delivers source-built, tested, and verified patched packages you can trust. ## Introducing Fulfillment Dashboard: New artifact requests are now self-serve DevFeed: [Introducing Fulfillment Dashboard: New artifact requests are now self-serve]() Original publisher: [Read original article]() Published: 2026-02-12T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [dashboards](), [chainguard containers](), [chainguard](), [Containers](), [Development]() Tags: [chainguard](), [chainguard-containers](), [chainguard-factory](), [chainguard-images](), [console](), [customers](), [fulfillment-dashboard](), [real-time](), [scale](), [search](), [secure-software](), [self-service](), [self-service-container-images](), [visibility](), [workflows]() ### AI overview Chainguard introduces Fulfillment Dashboard, a self-service console for submitting, tracking, searching, and voting on secure container image requests. It provides lifecycle visibility, target delivery dates, deduplication, and community upvoting to help prioritize fulfillment. ### Source excerpt Fulfillment Dashboard gives Chainguard customers real-time visibility, tracking, and community voting for new secure container image requests. ## DevSecCon 2025 Recap: Securing the AI Revolution Together DevFeed: [DevSecCon 2025 Recap: Securing the AI Revolution Together]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-10-22T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [DevSecOps](), [snyk](), [Application Security](), [Security](), [ide](), [Pull Request](), [snyk-code](), [Development]() Tags: [2025](), [ai](), [also](), [blog](), [developer](), [devops](), [devsecops](), [ide](), [interest](), [pmm](), [secure-software](), [security](), [snyk](), [snyk-code](), [snyk-open-source](), [snyk-platform]() ### AI overview This DevSecCon 2025 recap examines how AI is changing software development and security. It covers AI-accelerated DevSecOps, securing code from the first prompt, and managing AI-native application chaos with Evo by Snyk. The article also highlights Snyk capabilities for IDEs, pull requests, Snyk Code, and AppSec governance. ### Source excerpt AI is changing development. Our DevSecCon 2025 recap covers the 3 critical stages: AI-Accelerated DevSecOps, securing code at the first prompt, and taming AI-native app chaos with Evo by Snyk. ## Chainguard + Booz Allen: Delivering Trusted Open-Source Software to U.S. Government Agencies DevFeed: [Chainguard + Booz Allen: Delivering Trusted Open-Source Software to U.S. Government Agencies]() Original publisher: [Read original article]() Published: 2025-10-15T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [container images](), [Containers](), [open-source-security](), [Vulnerabilities](), [Open Source](), [Security]() Tags: [announce](), [ato](), [booz-allen-hamilton](), [chainguard](), [chainguard-booz-partnership](), [chainguard-containers](), [chainguard-dod-partnership](), [chainguard-libraries](), [common-vulnerabilities-and-exposures](), [compliance](), [container-images](), [containers](), [engineering](), [fedramp](), [fips](), [government](), [hardened-containers](), [open-source](), [open-source-software](), [sboms](), [secure-by-default](), [secure-software](), [security](), [stateramp](), [supply-chain](), [vulnerabilities](), [zero-cve-container-images]() ### AI overview Chainguard and Booz Allen announced a partnership to help U.S. government agencies and defense programs secure software supply chains, reduce vulnerabilities, and accelerate compliance. The partnership combines Booz Allen's mission expertise with Chainguard's secure-by-default open-source software, including hardened containers that helped one defense-related program obtain authorization to operate in eight weeks. ### Source excerpt Chainguard and Booz Allen partner to help federal programs eliminate vulnerabilities, save engineering time, and accelerate compliance timelines. ## Engineers Want to Build, Not Maintain: Key Findings From Our 2026 Engineering Reality Report DevFeed: [Engineers Want to Build, Not Maintain: Key Findings From Our 2026 Engineering Reality Report]() Original publisher: [Read original article]() Published: 2025-10-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Developer experience](), [code productivity](), [Artificial Intelligence](), [Automation](), [toolchains](), [Security]() Tags: [2026](), [ai](), [automation](), [chainguard](), [chainguard-containers-report](), [chainguard-report](), [developer-experience](), [developer-experience-report](), [engineering-reality](), [engineering-reality-2025](), [productivity](), [report](), [secure-software](), [security](), [software-engineer](), [toolchains]() ### AI overview Chainguard's 2026 Engineering Reality Report, based on a survey of 1,200 engineers and technology leaders, examines the modern developer experience. It finds that automation and AI are reducing repetitive work, while technical debt, maintenance, fragmented tooling, workflow disruption, burnout, and limited trust continue to constrain productivity. Engineers consistently want more time to build, and the article connects secure, integrated tools with innovation and business growth. ### Source excerpt Chainguard surveyed 1,200 engineers and technology leaders to better understand the state of the developer experience today and where teams can improve. ## Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust DevFeed: [Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust]() Original publisher: [Read original article]() Published: 2025-10-06T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Containers](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [chainguard-custom-assembly](), [chainguard-images](), [containers](), [cves](), [provenance](), [sboms](), [secure-software](), [security](), [software-supply-chain-security](), [zero-cves]() ### AI overview The article explains how Chainguard helps businesses meet stricter software security requirements for self-hosted, cloud, packaged-agent, and embedded software. It focuses on zero known CVEs at delivery, verifiable SBOMs, provenance attestations, compatibility with security tooling, and the challenges of open source dependencies and container images. ### Source excerpt Chainguard's zero-CVE containers come with broad compatibility, custom assembly, verifiable provenance and SBOMs, and more to help you ship secure software. ## Using Tech to Tackle Homelessness. The Artisan of the Day Is Kevin McKee. DevFeed: [Using Tech to Tackle Homelessness. The Artisan of the Day Is Kevin McKee.]() Original publisher: [Read original article]() Author: Ana Tavares Published: 2025-09-17T15:16:18Z Content type: article Language: en Sources: [Laravel Blog]() Topics: [Laravel](), [Software as a service](), [Software](), [Framework](), [Security]() Tags: [cto](), [developers](), [laravel](), [platform](), [saas](), [secure-software](), [software]() ### AI overview Kevin McKee, CTO of Padmission, describes how Laravel powers the company's SaaS platform for government agencies, nonprofits, and case managers addressing homelessness. Laravel's speed, productivity, and security help a small team deliver affordable, scalable tools for housing services. ### Source excerpt Kevin McKee, CTO of Padmission, explains how he uses Laravel to power the SaaS platform helping communities fight homelessness with secure software solutions. ## Why Chainguard's Full-Stack Approach to Secure Software Supply Chain Is Built to Scale DevFeed: [Why Chainguard's Full-Stack Approach to Secure Software Supply Chain Is Built to Scale]() Original publisher: [Read original article]() Published: 2025-07-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard os](), [chainguard](), [Open Source]() Tags: [automated](), [chainguard](), [chainguard-factory](), [chainguard-os](), [cve](), [dependencies](), [open-source-artifacts](), [open-source-software-security](), [provenance](), [reproducibility](), [secure-software](), [secure-software-supply-chain](), [software-supply-chain](), [supply-chain-security]() ### AI overview The article presents Chainguard's integrated approach to software supply chain security, combining Chainguard OS with the Chainguard Factory. It describes reproducible source builds, incremental updates, traceable contents, verifiable metadata, and automated maintenance of open source artifacts. ### Source excerpt Learn how Chainguard OS and the Chainguard Factory delivers the only scalable path to secure, reliable software artifacts. ## Finding Software Flaws Early in the Development Process Provides Clear ROI DevFeed: [Finding Software Flaws Early in the Development Process Provides Clear ROI]() Original publisher: [Read original article]() Author: Nuno Loureiro Published: 2025-06-11T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Development](), [Vulnerabilities](), [sdlc](), [Security](), [Software](), [Software Engineering]() Tags: [application-security](), [awareness](), [blog](), [business](), [code-security](), [cost](), [development](), [devops](), [engineering](), [executive](), [ransomware](), [sdlc](), [secure-software](), [security](), [snyk-platform](), [software](), [software-development](), [us](), [vulnerabilities]() ### AI overview The article explains that poor and insecure software creates substantial costs and security risks, while finding software flaws early in the software development life cycle provides a clear return on investment. It describes how vulnerabilities that reach production can expose organizations to breaches, data theft, lateral movement, and ransomware, and argues that organizations should improve software quality and identify security flaws during development. ### Source excerpt The Consortium for Information and Software Quality estimated that the cost of poor software quality in the United States reached $2.41 trillion in 2022. As we will show, it makes sense that the cost of poor software quality is so high. It's also completely avoidable, and software flaws must be avoided with the world's increased dependency on software. ## One Year Later: Signing CISA's Secure by Design Pledge DevFeed: [One Year Later: Signing CISA's Secure by Design Pledge]() Original publisher: [Read original article]() Published: 2025-06-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [cisa](), [cve remediation](), [container images](), [MFA](), [Security](), [Single sign-on (SSO)](), [passwords](), [chainguard vms](), [ssh]() Tags: [authentication](), [chainguard](), [chainguard-containers](), [chainguard-vms](), [cisa](), [container-images](), [cve](), [cve-remediation](), [mfa](), [okta](), [password](), [passwords](), [secure-by-design](), [secure-by-design-pledge](), [secure-software](), [security](), [shift-left](), [ssh](), [sso](), [vulnerabilities](), [vulnerability-management]() ### AI overview Chainguard reviews its progress one year after signing CISA's Secure by Design pledge, including CVE remediation across its container images, company-wide MFA through Okta SSO, and password-free access with automated SSH key provisioning for Chainguard VMs. ### Source excerpt Chainguard signed CISA's Secure by Design pledge in 2024. One year later, we look at progress we've made in key areas like CVE remediation and disclosures. ## Demonstrably Secure Software Supply Chains with Nix DevFeed: [Demonstrably Secure Software Supply Chains with Nix]() Original publisher: [Read original article]() Author: Jacek Galowicz Published: 2025-05-12T00:00:00Z Content type: article Language: en Sources: [Nixcademy Blog]() Topics: [Nix](), [supply-chain-security](), [open-source-security](), [integrity](), [Security](), [toolchains](), [audit]() Tags: [audit](), [audits](), [builds](), [capabilities](), [compilers](), [compliance](), [environments](), [government](), [integrity](), [local](), [offline](), [organizations](), [rebuilds](), [secure-software](), [security](), [software](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain](), [supply-chain-security]() ### AI overview This article explains how Nix can support verifiable software supply chain integrity. It describes tracing sources and toolchains, enabling hermetic offline rebuilds, and exporting release sources for audits to help meet regulatory requirements. ### Source excerpt Discover how Nix can revolutionize your software supply chain security, enabling verifiable integrity and offline rebuilds from source. ## Key Takeaways from Chainguard Assemble 2025 DevFeed: [Key Takeaways from Chainguard Assemble 2025]() Original publisher: [Read original article]() Published: 2025-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard libraries](), [supply-chain-security](), [chainguard containers](), [open-source-security](), [chainguard os](), [chainguard vms](), [Open Source](), [Security]() Tags: [2025](), [assemble-2025](), [chainguard](), [chainguard-assemble](), [chainguard-containers](), [chainguard-libraries](), [chainguard-os](), [chainguard-vms](), [datadog](), [open-source](), [oz-pearlman](), [secure-software](), [software-development](), [software-supply-chain-security]() ### AI overview Chainguard Assemble 2025 brought together security and engineering professionals to discuss secure software development, software supply chain security, and open source software. Chainguard highlighted Chainguard Containers, Chainguard Libraries, Chainguard VMs, and Chainguard OS, while also announcing partnerships and providing access to keynote and selected session recordings. ### Source excerpt Chainguard announced Chainguard Libraries, Chainguard VMs, and a new partnership with Datadog at Assemble, our inaugural event for security and developer pros. ## Chainguard Starter Images Now Available in Iron Bank: Minimal, Secure, and Reliable DevFeed: [Chainguard Starter Images Now Available in Iron Bank: Minimal, Secure, and Reliable]() Original publisher: [Read original article]() Published: 2025-03-06T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard images](), [supply-chain-security](), [container images](), [Security](), [Vulnerabilities]() Tags: [chainguard](), [chainguard-starter-images](), [container](), [container-images](), [iron-bank](), [sboms](), [secure-by-default](), [secure-software](), [software-supply-chain-security](), [vulnerabilities](), [zero-cve-container-images](), [zero-cves]() ### AI overview Chainguard Starter Images are now available in the Iron Bank image repository. The images are designed to reduce vulnerability findings, simplify VAT remediation, and streamline the path to Authorization to Operate. Chainguard describes them as secure-by-default images built from source with signed and attested artifacts, build-time SBOMs, hardened compiler settings, and reduced attack surfaces. ### Source excerpt Chainguard Starter Images are zero CVE container images that are now available in the Iron Bank image repository. ## NIS2: Understanding key software security requirements DevFeed: [NIS2: Understanding key software security requirements]() Original publisher: [Read original article]() Published: 2025-02-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability management](), [open-source-security](), [supply-chain-security](), [Cybersecurity](), [Critical Infrastructure](), [Development]() Tags: [compliance](), [cve-management](), [cve-reporting](), [energy](), [eu](), [europe](), [infrastructure](), [manufacturing](), [nis2](), [risk-management](), [sboms](), [secure-software](), [software-supply-chain](), [transportation](), [vulnerability-management]() ### AI overview This article explains how the European Union's NIS2 directive expands software security and vulnerability management requirements, shifts accountability to management and boards, and affects organizations operating in the EU. It discusses software supply chain security, open source development, SBOMs, CVE reporting, risk management, and the workload these requirements may create for security and developer teams. ### Source excerpt The European Union's Network and Information Systems 2 is a compliance framework with strict requirements around vulnerability management. ## Chainguard Signs CISA's Secure Software Development Attestation Form DevFeed: [Chainguard Signs CISA's Secure Software Development Attestation Form]() Original publisher: [Read original article]() Published: 2025-02-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard](), [open-source-security](), [Cybersecurity]() Tags: [announce](), [chainguard](), [chainguard-images](), [cisa](), [container-images](), [cybersecurity](), [fedramp](), [government](), [nist](), [product-security](), [provenance](), [secure-software](), [software-supply-chain-security](), [standards](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview Chainguard announces that it has signed CISA's Secure Software Development Attestation Form. The attestation states that Chainguard products align with NIST's Secure Software Development Framework and federal software supply chain security requirements, including secure development environments, trusted source code supply chains, automated controls, and provenance data. ### Source excerpt Chainguard has recently signed CISA's Secure Software Development Attestation Form, attesting to the security of Chainguard and its products. ## Snyk named a Customer Favorite in The Forrester Wave™: Software Composition Analysis Software, Q4 2024 Report DevFeed: [Snyk named a Customer Favorite in The Forrester Wave™: Software Composition Analysis Software, Q4 2024 Report]() Original publisher: [Read original article]() Author: Peter McKay Published: 2024-11-13T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-open-source](), [Application Security](), [DevSecOps](), [Automation](), [Security](), [GitHub]() Tags: [acquisition](), [analytics](), [application-security](), [aspm](), [automation](), [awareness](), [blog](), [component](), [customer](), [developer-security-platform](), [devops](), [devsecops](), [executive](), [innovation](), [integration](), [megawatt](), [open-source-security](), [pmm](), [recognition](), [report](), [sca](), [secure-software](), [shift-left](), [snyk](), [snyk-open-source](), [software-composition-analysis](), [software-development](), [strategy](), [support]() ### AI overview Snyk announces that it was recognized as a Leader and a Customer Favorite in The Forrester Wave: Software Composition Analysis Software, Q4 2024. The article highlights Snyk's scores for strategy, risk intelligence, remediation and automation, reporting and analytics, toolchain integration, and component health, along with its developer-first approach to application security and DevSecOps. ### Source excerpt Snyk's developer-first approach secures recognition as a Customer Favorite and a Leader in The Forrester Wave™: Software Composition Analysis (SCA) Software, Q4 2024 report. ## Meet Snyk for Government: Our developer security solution with FedRAMP ATO DevFeed: [Meet Snyk for Government: Our developer security solution with FedRAMP ATO]() Original publisher: [Read original article]() Author: Danny Allan Published: 2024-09-17T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [supply-chain-security](), [Application Security](), [Security](), [vulnerability management](), [Security & Privacy](), [GitHub]() Tags: [application-security](), [aspm](), [ato](), [awareness](), [blog](), [compliance](), [developer](), [devops](), [devsecops](), [engineering](), [executive](), [fedramp](), [fedramp-ato](), [government](), [public-sector](), [sbom](), [secure-software](), [security](), [shift-left](), [snyk](), [snyk-apprisk](), [software-supply-chain](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-management]() ### AI overview Snyk announces that Snyk for Government has received an authorization to operate from its FedRAMP sponsor, enabling public sector teams to use the offering while formal FedRAMP authorization progresses. The article describes application security, software supply chain protection, vulnerability and compliance intelligence, inline code scanning, and SBOM creation for government agencies. ### Source excerpt Discover how Snyk's FedRAMP-authorized platform empowers developers to build secure applications. Learn about our comprehensive solutions for vulnerability management, supply chain security, and AI code scanning. ## 3 ways AppSec modernization is a game-changer for financial services DevFeed: [3 ways AppSec modernization is a game-changer for financial services]() Original publisher: [Read original article]() Author: Katie DeMatteis Published: 2024-09-03T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [software-development](), [supply-chain-security](), [Security]() Tags: [application-security](), [awareness](), [blog](), [development](), [devops](), [executive](), [financial-services](), [finserv](), [fintech](), [interest](), [megawatt](), [modernization](), [secure-software](), [security](), [shift-left](), [software-development](), [supply-chain](), [supply-chain-security]() ### AI overview The article explains why financial services companies need to modernize application security as development becomes faster and more complex. It highlights developer adoption, shift-left security, regulatory compliance, and software supply-chain risks as central concerns. ### Source excerpt Learn why modernizing application security is essential for today's financial services companies. ## Chainguard enhances security with OSV advisory feed DevFeed: [Chainguard enhances security with OSV advisory feed]() Original publisher: [Read original article]() Published: 2024-07-02T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [vulnerability management](), [open-source-security](), [vulnerability](), [Vulnerabilities](), [Maintainers](), [chainguard images](), [data](), [Open Source](), [Google]() Tags: [chainguard](), [chainguard-images](), [google](), [maintainers](), [open-source](), [open-source-vulnerabilities](), [openssf](), [osv](), [secure-open-source](), [secure-software](), [security](), [vulnerability](), [vulnerability-data](), [vulnerability-management](), [wolfi]() ### AI overview Chainguard is publishing its security advisory feed in the OSV format, improving the precision and usability of vulnerability information for open source maintainers and downstream consumers. ### Source excerpt Explore Chainguard's new OSV advisory feed, delivering comprehensive and up-to-date vulnerability information to enhance your security posture. ## How to secure a REST API? DevFeed: [How to secure a REST API?]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-06-27T13:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [REST API](), [Security](), [API](), [Authentication](), [web applications](), [CRUD](), [Databases](), [SQL]() Tags: [api](), [application-security](), [authentication](), [awareness](), [backend](), [blog](), [code-security](), [data](), [developer](), [devrel](), [how-to](), [http](), [open-source-security](), [rest](), [rest-api](), [secure-software](), [security](), [snyk-code](), [snyk-open-source](), [web-applications](), [web-development]() ### AI overview This tutorial explains what REST APIs are, how they use HTTP to exchange data, and why their versatility creates security risks. It covers injection attacks, broken authentication, sensitive data exposure, and missing rate limiting, with examples including SQL injection, the 2018 Reddit breach, and the 2016 Dyn attack. ### Source excerpt In this post, we'll discuss what REST APIs are and how to secure them. ## Signing CISA's Secure by Design pledge DevFeed: [Signing CISA's Secure by Design pledge]() Original publisher: [Read original article]() Published: 2024-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [cisa](), [MFA](), [Security](), [Single sign-on (SSO)](), [OpenID connect (OIDC)](), [passwords](), [Auth0](), [Web]() Tags: [auth0](), [authentication](), [best-practices](), [chainguard](), [cisa](), [cve](), [mfa](), [oidc](), [password](), [passwords](), [phishing](), [secure-by-default](), [secure-by-design](), [secure-by-design-pledge](), [secure-software](), [security](), [security-best-practices](), [sso]() ### AI overview Chainguard describes signing CISA's Secure by Design pledge and explains how its products and internal systems address the pledge's goals. The article discusses passwordless human login through SSO, MFA requirements, phishing-resistant security keys, and limitations in provider support for OIDC MFA claims. ### Source excerpt Chainguard proudly signs CISA's Secure by Design pledge. Learn why we support this critical software security initiative. ## New Chainguard Academy course: Painless Vulnerability Management DevFeed: [New Chainguard Academy course: Painless Vulnerability Management]() Original publisher: [Read original article]() Published: 2024-02-14T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [vulnerability management](), [chainguard images](), [Security](), [supply-chain-security](), [Learning]() Tags: [chainguard](), [chainguard-academy](), [chainguard-images](), [container-image](), [container-security](), [course](), [cve](), [image-security](), [secure-software](), [security](), [software](), [software-supply-chain](), [software-supply-chain-security](), [vulnerability-management]() ### AI overview Chainguard announces a free-to-early-adopters Chainguard Academy course on vulnerability management. The course covers understanding, triaging, and mitigating vulnerabilities, standard tools and practices, and how Chainguard Images can support secure-by-default software development. ### Source excerpt Enroll in Chainguard Academy's new course on Painless Vulnerability Management to master security practices and use Chainguard Images for safer software. ## Announcing Bazel rules for extending Chainguard Images DevFeed: [Announcing Bazel rules for extending Chainguard Images]() Original publisher: [Read original article]() Published: 2023-10-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [supply-chain-security](), [container images](), [distroless](), [Package manager](), [Open Source]() Tags: [apk](), [apko](), [bazel](), [chainguard](), [chainguard-images](), [distroless](), [sbom](), [secure-software](), [secure-software-supply-chain](), [wolfi]() ### AI overview Chainguard and Aspect.Dev announce the general availability of rules_apko, an open source Bazel plugin for building secure, minimal Wolfi-based OCI container images. The article explains how rules_apko integrates APK packages and Wolfi-base images into existing Bazel workflows, supports reproducible builds, and provides dependency locking, integrity verification, and SBOM generation. ### Source excerpt Explore Bazel rules for Chainguard Images, your pathway to secure, effortless image extension. [Next page]()