# security engineering Published articles for security engineering. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go's SSH Library DevFeed: [How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go's SSH Library]() Original publisher: [Read original article]() Author: info@goteleport.com (Rob Picard) Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cryptographic audit](), [Go Language](), [ssh](), [Security](), [vulnerability]() Tags: [analysis](), [audit](), [bugs](), [cryptographic-audit](), [cryptography](), [go](), [security](), [security-engineering](), [ssh](), [vulnerability]() ### AI overview Teleport describes a critical vulnerability caused by two interacting bugs in its SSH certificate validation logic and reports that NCC Group conducted a cryptographic audit of Go's SSH package. The audit resulted in nine CVEs and identified subtle issues requiring expert review. ### Source excerpt Learn about NCC Group's cryptographic audit of Go's SSH package. ## Visibility at scale: How Figma detects sensitive data exposure DevFeed: [Visibility at scale: How Figma detects sensitive data exposure]() Original publisher: [Read original article]() Author: Dave Martin Published: 2025-10-23T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Security](), [Monitoring](), [Authorization](), [distributed-systems](), [Figma]() Tags: [authorization](), [distributed-systems](), [infrastructure](), [monitoring](), [privacy](), [real-time](), [scale](), [security](), [security-engineering](), [validation]() ### AI overview Figma describes Response Sampling, a lightweight real-time control that monitors outbound responses, validates access, and provides early warning of potential sensitive data exposure. The system is designed to detect authorization flaws and unexpected data leaks across distributed application services, both before production and after deployment. ### Source excerpt Solving security challenges at scale requires creativity as much as rigor. To reduce the risk of sensitive data exposure, we built Response Sampling: a lightweight, real-time control that watches outbound responses, validates access, and provides an early warning system across our products. ## This Shit is Hard: SLSA L3 and Beyond DevFeed: [This Shit is Hard: SLSA L3 and Beyond]() Original publisher: [Read original article]() Published: 2025-07-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard](), [Containers](), [Security]() Tags: [chainguard](), [chainguard-containers](), [compliance](), [containers](), [provenance](), [security](), [security-engineering](), [signing](), [slsa](), [software-supply-chain](), [software-supply-chain-security]() ### AI overview Chainguard explains how it uses SLSA to strengthen software supply chain security, support customer compliance, and build trust in hardened container images. The article focuses on SLSA Build Level 3, especially isolated build execution and tamper-resistant provenance attestations with signing secrets separated from build and test processes. ### Source excerpt Chainguard goes through all the necessary steps to make things SLSA 3 compliant. Get the details on how we do it. ## Day in the life of a food giant CISO DevFeed: [Day in the life of a food giant CISO]() Original publisher: [Read original article]() Author: Vandana Verma Sehgal Published: 2024-04-18T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Cybersecurity](), [Application Security](), [cloud-infrastructure](), [engineering-culture](), [Architecture & Design]() Tags: [application-security](), [awareness](), [blog](), [ciso](), [cloud](), [compliance](), [devrel](), [devsecops](), [executive](), [governance](), [leadership](), [management](), [organizational](), [product-security](), [security](), [security-engineering](), [strategy]() ### AI overview This developer-focused interview profiles Sherif Mansour, Just Eat's Director of Information Security, and discusses his career, Just Eat's three-line information security model, and his responsibilities across platform security, cloud and infrastructure, product security, application security, security engineering, culture, and awareness. It also describes organizational leadership principles and a themed weekly schedule for managing priorities. ### Source excerpt Snyk's Vandana Verma Sehgal sat down with Sherif Mansour, the Director of InfoSec at JustEat, for a "Day in the life of a CISO" session to learn more about his day-to-day experience as a security leader. ## Enforcing device trust on code changes DevFeed: [Enforcing device trust on code changes]() Original publisher: [Read original article]() Author: Griffin Choe Published: 2023-12-08T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Device Trust](), [Figma](), [GitHub](), [Security](), [pull-requests](), [Single sign-on (SSO)](), [WebAuthn](), [OAuth](), [ssh](), [Cryptography]() Tags: [cryptographic](), [device-trust](), [encryption](), [figma](), [git](), [github](), [oauth](), [okta](), [pull-requests](), [security](), [security-engineering](), [ssh](), [sso](), [verification]() ### AI overview Figma's security engineering team describes enforcing device trust for code changes merged into GitHub release branches. The approach combines commit signature verification with Okta Device Trust certificates to ensure changes originate from trusted, company-managed devices, while addressing risks from leaked credentials, tokens, and SSH keys. ### Source excerpt Here's how the Figma security engineering team leveraged commit signatures and Okta Device Trust certificates to protect GitHub release branches. ## Security Principles in 2023 DevFeed: [Security Principles in 2023]() Original publisher: [Read original article]() Author: Adam Published: 2023-10-27T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design]() Tags: [analysis](), [design](), [developer](), [security](), [security-engineering]() ### AI overview The author reflects on how their view of security design principles has changed. Although many principles remain valid, they are harder to learn, apply, teach, and assess consistently than threat modeling techniques because they require abstraction, careful analysis, and comparison of possible designs. ### Source excerpt Principles are lovely, but do they lead us to actionable results? ## Server-side sandboxing: An introduction DevFeed: [Server-side sandboxing: An introduction]() Original publisher: [Read original article]() Author: Hongyi Hu; Max Serrano Published: 2023-10-24T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Security](), [Vulnerabilities](), [Architecture & Design](), [Image processing](), [C++](), [Software]() Tags: [architecture](), [article](), [c-plus-plus](), [defense-in-depth](), [engineering](), [image-processing](), [infrastructure](), [security](), [security-engineering](), [vulnerabilities]() ### AI overview This introduction to server-side sandboxing explains why image processing, parsing, compression, and thumbnailing workloads can create security risks, especially when they depend on memory-unsafe software such as C++ libraries. It presents application-level sandboxing, or workload isolation, as a defense against vulnerabilities and outlines the challenge of choosing among available isolation techniques and balancing their trade-offs. ### Source excerpt In this three-part series, our security engineering team shares practical tips for deploying and operating application sandboxing techniques. First up: evaluating the many sandboxing options, and how to think about the trade-offs between them. ## Server-side sandboxing: Virtual machines DevFeed: [Server-side sandboxing: Virtual machines]() Original publisher: [Read original article]() Author: Hongyi Hu; Max Serrano Published: 2023-10-24T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Figma](), [Security](), [Vulnerabilities](), [Containers](), [Operating system](), [systems]() Tags: [containers](), [cpu](), [engineering](), [figma](), [os](), [security](), [security-engineering](), [security-vulnerabilities](), [virtual-machines]() ### AI overview This article explains how Figma uses server-side sandboxing with virtual machines to isolate workloads and reduce security risks. It examines the VM security model, including hypervisors, VM escape risks, permissions, and trade-offs compared with containers and seccomp. ### Source excerpt With so many sandboxing options, it's daunting to choose the right one. Here, we dive into the virtual machine (VM) security model for sandboxing, including the engineering trade-offs to consider and how we use them at Figma to achieve security isolation. ## My Career Pivot: From IT recruiter to information security DevFeed: [My Career Pivot: From IT recruiter to information security]() Original publisher: [Read original article]() Author: Skyscanner Engineering Published: 2022-06-24T08:08:19Z Content type: article Language: en Sources: [Stories by Skyscanner Engineering on Medium]() Topics: [Security](), [Cybersecurity]() Tags: [career](), [engineering](), [female-engineers](), [information-security](), [pci-dss](), [security](), [security-engineering](), [women-in-tech]() ### AI overview This profile follows Maria Sepulveda's career transition from customer service and IT recruitment into information security. As a Senior Security Engineer at Skyscanner, she discusses her role, career development, and responsibility for leading the recertification of the company's PCI DSS compliance. ### Source excerpt Senior Security Engineer Maria Sepulveda As we celebrate International Women in Engineering Day this week, we're profiling female-identifying engineers across our business. Maria Sepulveda is a Senior Security Engineer at Skyscanner. An expert within information security, Maria led the recertification of Skyscanner's PCI DSS (Payment Card Industry data Security Standard) compliance. Maria took an unconventional path to information security, starting her career in customer service and IT recruitment. Here, she discusses her journey, imposter syndrome and what her role looks like today. Maria, as a Senior Security Engineer, what does your role involve? Well, I only recently joined Skyscanner so a typical day for me today might look different to a typical day in a couple of months time! Having said that, I have already been given responsibility to lead the recertification of our PCI-DSS compliance. It's great that I can be trusted so early on in my Skyscanner journey. My day typically starts with following up on tasks that are due in the coming week. During the day I meet with people and various teams to understand what they do. I'll also attend internal events, often to better understand the Skyscanner culture and the way things work here -- as well as to make connections. Focus Time in the afternoon allows me to re-read my notes and absorb information I obtained during the day. The day might end with a recap of the day with my team, allowing me to ask questions I haven't already asked or just generally talk about how the day went. What was your career journey to this point? I took an unconventional path into information security. Originally from Australia, I worked in customer service roles and IT recruitment. I arrived in London and found a job working at an in-house recruitment team for an online betting company. I knew that I wanted to move into a more tech-focussed role but still interfacing with the business. My colleague who was recruiting for the security team ## Threat Modeling Thursday: 2018 DevFeed: [Threat Modeling Thursday: 2018]() Original publisher: [Read original article]() Author: Adam Published: 2018-07-12T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design]() Tags: [attacks](), [blackhat](), [engineering](), [framework](), [platforms](), [practices](), [security](), [security-engineering](), [series](), [social-media](), [talk](), [techniques]() ### AI overview The author asks readers what they want covered in the Threat Modeling Thursday series and in a Black Hat talk on threat modeling in 2018. The talk will address evolving attacks, system properties, attack techniques, social media threats, and keeping security engineering and threat modeling practices current. ### Source excerpt Help me help you. ## Security Engineering: Computers versus Bridges DevFeed: [Security Engineering: Computers versus Bridges]() Original publisher: [Read original article]() Author: Adam Published: 2018-04-11T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design]() Tags: [discussion](), [security](), [security-engineering](), [security-research]() ### AI overview This commentary compares security engineering with bridge engineering, arguing that public criticism, questioning, and investigation of failures are essential to improving designs and advancing the field. ### Source excerpt [no description provided] ## Reasonable Software Security Engineering Podcast DevFeed: [Reasonable Software Security Engineering Podcast]() Original publisher: [Read original article]() Author: Adam Published: 2018-04-02T00:00:00Z Content type: release Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Software]() Tags: [engineering](), [podcast](), [security](), [security-engineering](), [software]() ### AI overview ISACA released a podcast discussing the "Reasonable Software Security Engineering" perspectives article. The document says the podcast could be downloaded from ISACA, although the listed MP3 link no longer worked. ### Source excerpt [no description provided] ## Humble Bundle DevFeed: [Humble Bundle]() Original publisher: [Read original article]() Author: Adam Published: 2017-07-19T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Cybersecurity](), [Security](), [Security & Privacy]() Tags: [cybersecurity](), [security](), [security-engineering]() ### AI overview A Humble Bundle offers cybersecurity books, including works on threat modeling, security engineering, and cryptography. Proceeds support the Electronic Frontier Foundation and WaterAid America. ### Source excerpt [no description provided] ## The View From here DevFeed: [The View From here]() Original publisher: [Read original article]() Published: 2015-01-18T00:00:00Z Content type: opinion Language: en Sources: [Signal Blog]() Topics: [Security](), [Messaging](), [Protocol (disambiguation)](), [Ratchet](), [Architecture & Design](), [SSL]() Tags: [app-development](), [auth](), [blog](), [crypto](), [development](), [security](), [security-engineering]() ### AI overview The author describes helping develop TextSecure with Open Whisper Systems by applying the TripleDH idea, prekeys, and an improved OTR ratchet to asynchronous text messaging and email. The resulting core protocol was later refined for multiparty and multidevice use, with additional security features such as stronger authentication and metadata hiding. The article argues that text messaging is an important environment for rapidly deploying secure communication innovations and praises the team's combination of security engineering and user-friendly app development. ### Source excerpt Winter Break Of Code, Day 6 I've been working with Open Whisper Systems on TextSecure for about a year and a half. I feel like I've earned better treatment than being forced to blog at knifepoint, but here we are, so I'll tell my story. Read more...