# Application Security A cybersecurity discipline focused on protecting software applications through secure development and testing of technical security controls. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## When to use SAST versus an LLM security scanner DevFeed: [When to use SAST versus an LLM security scanner]() Original publisher: [Read original article]() Author: Chris Widstrom Published: 2026-09-16T00:00:00Z Content type: comparison Language: en Sources: [GitLab]() Topics: [Security](), [LLM security](), [Large Language Model](), [Application Security](), [Testing](), [Frontier Model](), [audit trail](), [business logic]() Tags: [application-security](), [audit-trail](), [features](), [frontier-model](), [llm](), [llm-security](), [product](), [sast](), [security](), [vulnerabilities]() ### AI overview This comparison explains when to use static application security testing (SAST) and when to use LLM-based security review. SAST provides predictable, repeatable, low-cost scanning across commits, while LLMs can reason about context and identify some intent-based or novel issues. The article recommends using both according to the task and scan scope. ### Source excerpt You're probably running some version of this experiment already: Point a frontier model at a merge request and ask it to double as a vulnerability scanner. On a single merge request, it often works well. The model reads the code, reasons about what it's supposed to do, and catches real issues, sometimes ones a pattern-based scanner misses entirely. So the next thought is reasonable: If a model reviews one merge request this well, why not let it replace the scanner across your whole pipeline? That's where it breaks down. Running a frontier model as your primary scanner on every commit across an enterprise codebase costs more and behaves less predictably, than asking it to review one merge request. If you run application security for a platform or product team, the decision was never mutually exclusive: static application security testing (SAST) or LLM scanners. It's which one runs where. Get that split right and you keep deterministic coverage on every commit, add reasoning where it earns its place, and avoid both an unpredictable inference bill and gaps in your audit trail. Here's how the two compare: Deterministic scanner (SAST)AI-based review (LLM)CostBetter Fractions of a cent per scan, fixed and predictable. A paid inference call per scan; cost scales with code volume and is hard to forecast.ConsistencyBetter Flags the same vulnerabilities, every time. Can flag or miss different vulnerabilities on the same code, run to run.Audit evidenceBetter Reproducible: same fixed method every time, mapped to a CWE Output can vary between runs, harder to use as standalone audit evidence.Vulnerability typesDepends on the vulnerability type Pattern-based, traceable flaws (injection)Depends on the vulnerability type Intent-based and novel flaws: missing auth checks, broken ownership logic, and issues not yet mapped to a CVE or CWE. Could reason about business logic using context from issues, epics, and docs.Validating a finding Flags potential vulnerabilities; can't confirm whe ## Support the well-known change password URL with Appwrite Auth DevFeed: [Support the well-known change password URL with Appwrite Auth]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [passwords](), [Appwrite](), [Application Security](), [web applications](), [W3C]() Tags: [bitwarden](), [deployment](), [passwords](), [security](), [tutorial](), [tutorials](), [w3c]() ### AI overview This tutorial shows how to support the well-known change password URL in a TanStack Start app using Appwrite Auth. It explains the redirect, the change-password form for signed-out visitors, autocomplete hints, and deployment to Appwrite Sites. ### Source excerpt Password managers open /.well-known/change-password when they find a leaked or weak password. Add the redirect and a change password page backed by Appwrite Auth. ## How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests DevFeed: [How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests]() Original publisher: [Read original article]() Author: Umair Mirza Published: 2026-09-14T22:23:01Z Content type: tutorial Language: en Sources: [freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More]() Topics: [Application Security](), [Security](), [Vulnerabilities](), [Secret Scanning](), [Git](), [pull-requests](), [ci](), [Command-line interface](), [.NET](), [Python](), [coding]() Tags: [application-security](), [ci](), [cli](), [code](), [devsecops](), [git](), [net](), [pull-requests](), [python](), [sast](), [secret-scanning](), [security](), [security-vulnerabilities](), [software-development](), [testing](), [vulnerabilities]() ### AI overview This tutorial explains how to shift security checks earlier in development by running SAST locally with Git pre-commit hooks. It demonstrates using the DevSkim CLI to detect insecure coding patterns, pairing it with Gitleaks for dedicated secret scanning, validating the setup with an intentional failure, and enforcing the checks in CI. ### Source excerpt Security reviews are most effective when developers receive feedback while the code is still fresh in their minds. Waiting until a pull request, CI build, or penetration test to find exposed credentia ## Co-Create: Building GitLab with our users DevFeed: [Co-Create: Building GitLab with our users]() Original publisher: [Read original article]() Author: Isa Huerga Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [CI/CD](), [Scala](), [Claude](), [Application Security](), [Cloud APIs]() Tags: [api](), [ci-cd](), [co-created](), [community](), [contributors](), [duo](), [engineering](), [open-source](), [rest-api](), [scala](), [security]() ### AI overview GitLab users collaborated through the Co-Create program on product improvements delivered in the first half of 2026, including API extensions, CI/CD capabilities, Scala support for AI-powered code understanding, security controls, and integration flexibility. ### Source excerpt GitLab users bring firsthand experience of the workflows they want to improve. Through our Co-Create program, they collaborate directly with us to design, build, and deliver product improvements that benefit more teams. In the first half of 2026, our users helped us extend APIs, add CI/CD capabilities, expand language support for AI-powered code understanding, strengthen security controls, increase the flexibility of integrations, and make GitLab easier to use and understand. Co-Create gives customers a direct path from a real-world challenge to a product improvement. Customers collaborate with us on the problem and solution, and help deliver the change. Unlike a feedback-only model, this puts real workflow context into the product development process. It creates a shorter path from need to value while helping us validate improvements in real conditions and extend their benefits to more GitLab users. "Over ten years ago, we set out to build code.siemens.com, our internal coding platform based on GitLab, which today serves close to 100,000 people. We've run and scaled the platform with a tiny team, guided by a 'for developers, from developers' philosophy. We co-created hundreds of features such as x509/gpg signed commits, protected container/packages, and project and social features such as follow users, allowing us to strengthen the security and collaboration culture at the scale of Siemens." -- Roger Meier, Distinguished Engineer, Siemens From a specific need to a shared improvement Some of the best product improvements start with a specific, real-world need. GitLab contributors helped us address the following needs: Making Scala codebases understandable to Orbit and GitLab Duo Giving security administrators a way to enforce Secret Push Protection across an entire instance Letting high-throughput teams configure merge train pipeline limits Showing the platforms supported by multi-architecture images Providing screen reader users with more context on documentation pa ## How to secure edge AI in customer-owned environments DevFeed: [How to secure edge AI in customer-owned environments]() Original publisher: [Read original article]() Author: Shayak Lahiri Published: 2026-09-04T19:10:10Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [AI Platforms/Deployment](), [Machine Learning, Security Attacks](), [Inference](), [Application Security](), [cloud-infrastructure]() Tags: [ai](), [attacks](), [cloud](), [customer](), [deployment](), [edge](), [frontier-ai-models](), [hardware](), [how-to](), [inference](), [models](), [security]() ### AI overview The article explains how moving AI inference and assets into customer-owned edge environments changes the security trust model. It recommends attestation, provenance, action mediation, and releasing sensitive assets only to trusted environments. ### Source excerpt As AI moves into customer-owned environments, organizations need new ways to verify the systems, software, and AI assets they trust before releasing sensitive data, credentials, and models. The post How to secure edge AI in customer-owned environments appeared first on Microsoft Security Blog. ## When AI skills become supply-chain dependencies DevFeed: [When AI skills become supply-chain dependencies]() Original publisher: [Read original article]() Author: Nubank Editorial Published: 2026-09-02T16:47:57Z Content type: article Language: en Sources: [Nubank]() Topics: [Security](), [supply-chain-security](), [Application Security](), [Development](), [Software]() Tags: [ai](), [ai-research](), [developer](), [development](), [product-security](), [security](), [supply-chain]() ### AI overview Nubank describes how AI skills and related components are expanding the software supply chain. Its security team reviewed more than 2,000 AI skills before distribution and argues that security controls must evolve as AI becomes part of the developer toolchain. ### Source excerpt How Nubank vetted 2,000+ AI skills before distribution, building security into the developer workflow without turning safety into a separate gate The post When AI skills become supply-chain dependencies appeared first on Building Nubank. ## MAST in the Age of Open Source Software |Guardsquare DevFeed: [MAST in the Age of Open Source Software |Guardsquare]() Original publisher: [Read original article]() Author: Simon Haven - Product Marketing Manager Published: 2026-09-01T10:59:01Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Open Source](), [Mobile Security](), [Application Security](), [Vulnerabilities](), [Social engineering](), [npm]() Tags: [app-security-testing](), [application-security](), [appsweep](), [general](), [malware](), [mobile](), [mobile-apps](), [npm](), [open-source](), [open-source-software](), [social-engineering](), [supply-chain](), [vulnerabilities]() ### AI overview This article explains why mobile application security testing is important when apps use free and open source software. It describes how vulnerable, deprecated, compromised, and transitive third-party dependencies can expand an app's attack surface, citing a September 2025 npm supply chain attack as an example. ### Source excerpt Building with free and open source software (FOSS) has become common practice for app developers. In 2022, it was estimated that between 70% and 90% of any given software codebase was made up of open source components. Leveraging open source projects presents many advantages: ## ICYMI: July 2026 @AWS Security DevFeed: [ICYMI: July 2026 @AWS Security]() Original publisher: [Read original article]() Author: Rodolfo Brenes Published: 2026-08-26T19:32:55Z Content type: news Language: en Sources: [AWS Security Blog]() Topics: [Application Security](), [AI-assisted coding](), [AWS IAM]() Tags: [ai-agent](), [ai-coding](), [ai-security](), [amazon-bedrock](), [announcements](), [aws](), [compliance](), [ddos](), [firewall](), [foundational-100](), [iam](), [secrets](), [security](), [security-blog](), [security-identity-compliance]() ### AI overview A July 2026 AWS Security roundup covering AI-agent security, data protection, supply-chain protection, firewall automation, DDoS mitigation, and compliance readiness. ### Source excerpt If you found time for a bit of vacation this summer, you might be in catch-up mode. Here's a list to help: all the expert blog posts, new service capabilities, code samples, and workshops, in case you missed it, from July 2026. AWS Security Blog post This month's AWS Security Blog posts covered AI agent [...] ## Why Your AI Application Is Exposed DevFeed: [Why Your AI Application Is Exposed]() Original publisher: [Read original article]() Author: Damian Tommasino Published: 2026-08-26T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [AI Development](), [Large Language Model](), [vulnerability](), [Model Context Protocol](), [Retrieval Augmented Generation (RAG)](), [Machine Learning, Security Attacks](), [data]() Tags: [ai](), [ai-red-team](), [application-security](), [awareness](), [blog](), [devops](), [executive](), [interest](), [llm](), [mcp](), [rag](), [security](), [testing](), [vulnerability]() ### AI overview The article explains why AI applications can pass conventional security scans and model evaluations while remaining exploitable through chained interactions among prompts, language models, retrieval, tools, and backend workflows. It presents DAST, AI penetration testing, and AI red teaming as complementary lenses for identifying exposed surfaces, exploitable paths, and real-world adversary outcomes. ### Source excerpt AI applications can pass security scans yet remain exploitable through chained attacks across models, tools, data, and business workflows. Learn how DAST, AI pentesting, and red teaming work together to expose end-to-end risk. ## Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain DevFeed: [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain]() Original publisher: [Read original article]() Author: Yaron Avital Published: 2026-08-21T23:00:21Z Content type: article Language: en Sources: [Unit 42]() Topics: [sdlc](), [Security](), [Application Security](), [CI/CD](), [GitHub Actions](), [npm](), [Bun](), [Python](), [Claude Code](), [vs-code](), [Claude](), [Ethereum]() Tags: [blockchain](), [c2](), [chaindrop](), [ci-cd](), [claude-code](), [general](), [github-actions](), [insights](), [malware](), [npm-packages](), [persistence](), [python](), [sdlc](), [security](), [software-supply-chain-attack](), [supply-chain](), [vs-code]() ### AI overview Unit 42 describes how software supply-chain attackers are targeting developer tools, CI/CD pipelines, accounts, packages, setup scripts and developer environments before software reaches production. It examines the ChainDrop npm worm, which used malicious preinstall hooks, a Bun runtime, an obfuscated payload, Python-based memory theft, stolen tokens and secrets, self-propagation, persistence in VS Code and Claude Code, and Ethereum-managed command-and-control infrastructure. ### Source excerpt Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42. ## Where Security Fits in an AI Agent Stack DevFeed: [Where Security Fits in an AI Agent Stack]() Original publisher: [Read original article]() Author: Michelle Horton Published: 2026-08-21T13:00:00Z Content type: article Language: en Sources: [NVIDIA Developer](), [NVIDIA Technical Blog]() Topics: [AI Bots](), [Application Security]() Tags: [agentic-ai-generative-ai](), [ai-agent](), [ai-safety](), [ai-security](), [inference](), [nvidia-research](), [openshell](), [security](), [trustworthy-ai-cybersecurity]() ### AI overview The article explains where security controls fit in an emerging AI agent stack. It emphasizes runtime boundaries, scoped access, authorization, isolation, auditability, and defense in depth rather than relying solely on prompts, model safeguards, or harness logic. ### Source excerpt As AI agents become more capable and operate over longer horizons, building security and trust into the applications they power becomes increasingly important.... ## Detect vulnerabilities in LLM applications with Datadog's AI-native SAST DevFeed: [Detect vulnerabilities in LLM applications with Datadog's AI-native SAST]() Original publisher: [Read original article]() Author: Jon Green; Bahar Shah Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [Vulnerabilities](), [Application Security](), [AI, ML & Data Engineering](), [ci]() Tags: [ai](), [ai-security](), [application-security](), [applications](), [ci](), [code-security](), [llm](), [security](), [threat-detection](), [vulnerabilities]() ### AI overview Datadog describes an AI-native SAST capability for finding LLM-specific application vulnerabilities, including prompt injection, excessive agency, and hidden-context exposure. It uses code context and data-flow reasoning, verifies findings, and surfaces results in pull requests and CI checks. ### Source excerpt Datadog Code Security's AI-native SAST helps detect vulnerabilities specific to the OWASP Top 10 for LLM Applications before they reach production. ## When your backlog outgrows your team, GitLab scales remediation DevFeed: [When your backlog outgrows your team, GitLab scales remediation]() Original publisher: [Read original article]() Author: Alisa Ho Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Application Security](), [Vulnerabilities](), [Security](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [application-security](), [developer](), [features](), [product](), [security](), [vulnerabilities]() ### AI overview GitLab 19.3 introduces bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution for existing production vulnerability backlogs. The features assess findings, identify likely false positives, and generate ready-to-merge fixes for confirmed vulnerabilities, including findings imported from third-party SARIF scanners. ### Source excerpt Security teams have historically struggled to keep up with triage and remediation when development was happening at human speed. Today, that challenge is exacerbated by developers writing and shipping code at machine speed with AI. At the same time, AI is helping attackers find and exploit vulnerabilities faster in production. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation overtook credential abuse as the top breach entry point. Vulnerability exploitation accounts for 31% of breaches versus just 13% in previous years, and only 26% of known exploited vulnerabilities were remediated this year, down from 38%. That means more breaches are starting with a vulnerability that was already sitting in production, unpatched. In GitLab 19.3, teams can now run Static Application Security Testing (SAST) False Positive Detection and Agentic SAST Vulnerability Resolution, in bulk, on their existing vulnerability backlog. Dismiss false positives and remediate vulnerabilities in bulk Most teams have a known vulnerabilities backlog already running in production, far more than any team has time to open and triage one at a time. That used to be a workload problem. Now it's a timing problem too: The same AI accelerating development is accelerating exploitation, which means findings that sit in the backlog longer carry more risk than they used to. GitLab addresses this with two layers of automated triage and remediation. The first covers active vulnerabilities in production. With GitLab 19.3, teams can bulk-select multiple vulnerabilities to run agentic flows, SAST False Positive Detection and Agentic SAST Vulnerability Resolution, against the vulnerability backlog in production. SAST False Positive Detection analyzes a finding's surrounding code and returns a confidence score and explanation for whether it's a real risk or a false positive. Agentic SAST Vulnerability Resolution takes findings confirmed as real risk and opens a ready-to-merge fix that re ## Putting models to the secure coding test: Plan vs default mode DevFeed: [Putting models to the secure coding test: Plan vs default mode]() Original publisher: [Read original article]() Author: Kennedy Toomey Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [AI-assisted coding](), [Application Security](), [code security](), [Code quality](), [Vulnerabilities](), [Claude](), [cursor](), [codex]() Tags: [application-security](), [claude](), [code-quality](), [code-security](), [codex](), [command-line](), [cursor](), [supply-chain](), [vulnerabilities]() ### AI overview This article describes an experiment comparing plan mode with default mode for secure code generation. The author tested Sonnet 5, Composer 2.5, and GPT 5.5 through Claude, Cursor, and Codex, using security and code-quality analysis to assess the results. ### Source excerpt We tested Sonnet 5, Composer 2.5, and GPT 5.5 in plan mode and default mode to see whether plan mode produces measurably more secure code. ## Remediation Agents, Demystified: Why Fixing Beats Finding DevFeed: [Remediation Agents, Demystified: Why Fixing Beats Finding]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Vulnerabilities](), [AI-assisted coding](), [pull-requests](), [Responsibility & Safety](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [ai-agents](), [application-security](), [aspm](), [awareness](), [ci-cd](), [code-security](), [community](), [developer](), [devops](), [devsecops](), [enablement](), [interest](), [javascript](), [live-stream](), [node-js](), [pull-requests](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [validation](), [vs-code](), [vulnerabilities]() ### AI overview Snyk's Remediation Agent is presented as a public-preview solution for the growing security-issue backlog. The article explains how coding agents can increase vulnerabilities, why deterministic remediation advice has not been enough, and how validation helps turn fixes into mergeable pull requests. ### Source excerpt See how Snyk's Remediation Agent uses security intelligence, breakability analysis, and validation to turn vulnerabilities into mergeable pull requests. ## How Mobile App Security from Guardsquare Addresses Gaps in Framework Compliance DevFeed: [How Mobile App Security from Guardsquare Addresses Gaps in Framework Compliance]() Original publisher: [Read original article]() Author: Guest post by Dr. Edward Amoroso, CEO, TAG Infosphere Inc. and former AT&T Chief Security Officer Published: 2026-08-11T14:00:31Z Content type: opinion Language: en Sources: [Guardsquare Blog]() Topics: [Mobile Security](), [Application Security](), [Security](), [Cybersecurity](), [Artificial Intelligence]() Tags: [application-security](), [compliance](), [credentials](), [cybersecurity](), [frameworks](), [governance](), [hardening](), [mobile](), [protection](), [regulatory](), [report](), [security](), [standards]() ### AI overview A featured guest post examines how mobile application security, including Guardsquare's hardening, runtime protection, and anti-tampering capabilities, can help enterprises address gaps in compliance frameworks. It also argues that frameworks such as NIST CSF 2.0 should more explicitly account for mobile app risk. ### Source excerpt Former AT&T Chief Security Officer and TAG Infosphere founder Dr. Edward Amoroso shares his perspective on the state of mobile application security in a featured guest post for Guardsquare. Enterprise compliance is evolving as organizations face mounting regulatory pressure and more capable threat actors. Regulators now expect alignment to frameworks such as National Institute of Standards and Technology Cybersecurity Framework (CSF) 2.0 and sector-specific mandates. Yet, while governance has matured around cloud, endpoint, and networks, mobile app risk remains underrepresented in compliance frameworks and control processes. ## How to let AI agents act on behalf of users without handing them access tokens DevFeed: [How to let AI agents act on behalf of users without handing them access tokens]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-10T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [Artificial Intelligence](), [Application Security](), [Security]() Tags: [ai](), [ai-agents](), [application-security](), [logging](), [oauth](), [observability](), [security]() ### AI overview This article explains why giving AI agents long-lived OAuth access tokens creates security risks. It describes how untrusted content can influence agent behavior and cause tokens to appear in context windows, tool-call logs, model-provider logs, and other unintended locations. ### Source excerpt Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it. ## Continuous Offensive Security & AI Pentesting: 20 FAQs DevFeed: [Continuous Offensive Security & AI Pentesting: 20 FAQs]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-08-05T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security]() Tags: [agentic](), [agents](), [ai](), [ai-agents](), [apis](), [application-security](), [awareness](), [blog](), [cos](), [event-driven](), [security](), [snyk-platform](), [testing](), [validation](), [vulnerability]() ### AI overview An FAQ-style article on continuous offensive security, combining recurring and event-driven testing with DAST, AI penetration testing, and AI red teaming to identify and validate application risk as applications change. ### Source excerpt Get answers to 20 common questions about continuous offensive security, AI penetration testing, DAST, and AI red teaming. ## AI SAST: Challenges for Application Security Teams DevFeed: [AI SAST: Challenges for Application Security Teams]() Original publisher: [Read original article]() Author: Nicole Morgan Published: 2026-08-05T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Application Security](), [Artificial Intelligence](), [AI Development](), [software composition analysis]() Tags: [ai](), [ai-coding](), [application-security](), [sast](), [sca](), [vulnerabilities]() ### AI overview This article discusses how AI-assisted development increases pressure on static application security testing (SAST) programs. It identifies false positives, vulnerability backlogs, low remediation rates, and limited pipeline coverage as obstacles to helping developers address findings quickly. ### Source excerpt Learn how AI is transforming SAST, reducing security friction, and helping teams secure AI-generated code without slowing delivery. | Blog ## Introducing Deputy: Better signal and control for software supply chains DevFeed: [Introducing Deputy: Better signal and control for software supply chains]() Original publisher: [Read original article]() Author: Kent Gruber Published: 2026-08-03T00:00:00Z Content type: release Language: en Sources: [Temporal Blog]() Topics: [supply-chain-security](), [Application Security](), [Command-line interface](), [Open Source]() Tags: [application-security](), [cli](), [open-source](), [software](), [supply-chain](), [supply-chain-security](), [temporal-voices]() ### AI overview Temporal introduces Deputy, an open-source, CLI-first security toolchain for inventorying, scanning, triaging, and controlling dependencies across repositories, container images, VM disk images, SBOMs, and other targets. It provides a customizable policy layer for local use, CI, and download-time controls. ### Source excerpt Meet Deputy, Temporal's open-source, CLI-first toolchain for inventorying, scanning, triaging, and controlling dependencies across your supply chain. ## Why Appsec Teams Need Internal Developer Portals DevFeed: [Why Appsec Teams Need Internal Developer Portals]() Original publisher: [Read original article]() Author: Yonatan Boguslavski Published: 2026-07-30T10:09:05Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [internal developer portal](), [Application Security](), [Platform Engineering](), [sdlc](), [Vulnerabilities](), [Security]() Tags: [application-security](), [cognitive-load](), [dependency](), [developer-portal](), [internal-developer-portal](), [open-source-security](), [platform-engineering](), [security](), [vulnerabilities](), [vulnerability]() ### AI overview The article explains how internal developer portals can help AppSec teams support self-sufficient developers by consolidating vulnerability and misconfiguration data from multiple security tools and software development stages. By providing security information in context through catalogs, self-service remediation actions, and scorecards, portals can reduce cognitive load and dependency on AppSec teams. ### Source excerpt If you want self-sufficient developers working in a "you build it you own it" world, you need an internal developer portal. ## Building an agentic harness that outlasts the model DevFeed: [Building an agentic harness that outlasts the model]() Original publisher: [Read original article]() Author: Zack Deveau Published: 2026-07-29T15:30:00Z Content type: article Language: en Sources: [Shopify Engineering](), [Shopify Engineering - Shopify Engineering]() Topics: [Application Security](), [Shopify](), [Vulnerabilities](), [Code review](), [Orchestration](), [pull-requests](), [Rails](), [Ruby](), [web applications](), [Back end]() Tags: [agentic](), [application-security](), [backend](), [building](), [code](), [orchestration](), [pull-requests](), [review](), [ruby](), [shopify](), [vulnerabilities](), [web-applications](), [workflow]() ### AI overview Shopify describes an agentic code review and test-oracle harness for application security. The harness scans software for vulnerabilities, validates findings with real tests, generates Shopify-specific fixes, and opens relevant pull requests. The article also explains its Dispatch orchestrator, parallel scanning workflow, reusable application context, and diff-based follow-up scans. ### Source excerpt We built an agentic code review and test oracle harness that discovers vulnerabilities, proves them with real tests, and provides Shopify-tuned fixes. ## pnpm vs. npm: Which package manager should you use? DevFeed: [pnpm vs. npm: Which package manager should you use?]() Original publisher: [Read original article]() Author: Chinwike Maduabuchi Published: 2026-07-28T13:00:17Z Content type: article Language: en Sources: [LogRocket Blog]() Topics: [npm](), [Security](), [supply-chain-security](), [JavaScript](), [Application Security](), [Yarn]() Tags: [application-security](), [article](), [dev](), [javascript](), [security](), [supply-chain](), [uncategorized](), [vulnerabilities]() ### AI overview This article compares npm and pnpm as JavaScript package managers, focusing on security defaults, disk usage, dependency strictness, workspace behavior, and software supply chain risk. It explains how pnpm's content-addressable store and linked dependencies improve efficiency while stricter installation policies can make migrations more demanding. ### Source excerpt Compare pnpm and npm across security defaults, disk usage, dependency strictness, and workspace policy to decide which package manager fits your project. The post pnpm vs. npm: Which package manager should you use? appeared first on LogRocket Blog. ## Mobile App Security Without Sacrificing UX | Guardsquare DevFeed: [Mobile App Security Without Sacrificing UX | Guardsquare]() Original publisher: [Read original article]() Author: Ryan Lloyd - Chief Product Officer Published: 2026-07-21T13:02:06Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Mobile Security](), [Application Security](), [Security](), [obfuscation](), [User experience (UX)](), [Reverse Engineering](), [Jailbreak](), [debug]() Tags: [application-security](), [jailbreak](), [mobile](), [obfuscation](), [performance](), [profiling](), [reverse-engineering](), [security](), [technical](), [time](), [ux]() ### AI overview The article explains how profiling instrumented mobile applications helps teams apply obfuscation and runtime security controls at appropriate levels while limiting effects on stability, performance, and user experience. It also discusses automating application profiling at scale through AI-driven and agentic testing. ### Source excerpt Mobile application security has evolved significantly over the past decade. Modern applications routinely employ code obfuscation, runtime application self-protection (RASP), anti-tampering controls, jailbreak and root detection, debugger detection, certificate pinning, and a variety of other runtime defenses designed to protect intellectual property and sensitive user data. [Next page]()