Learn about agentic coding security and Endor Labs

OWASP Top 10 Adds A03:2025: Software Supply Chain Failures

Critical SQL Injection Vulnerability in Django (CVE-2025-64459)

False Negatives in SAST: Hidden Risks Behind the Noise

State of Dependency Management 2025

Why AI Code Gets Less Secure With Every Prompt

From Shift Left to Shift Down: Making SAST Work for Developers

Why SAST Failed (And What’s Next)

CVE-2025-53967 Remote Code Execution in Framelink Figma MCP Server

Rethinking the Interface: How Agentic UX is Shaping the Future of Endor Labs

Proactive Protection from Malware Attacks

Why Cooldown Windows Belong in Every npm Security Strategy

Zero Trust for Open Source: Why Enterprises Need a New AppSec Playbook

It’s Time to Take Malware Seriously (Attackers Do)

Fireside Chat: Building an AppSec Program for Cursor

A Practical Guide to AI and Application Security

How to Defend Against NPM Software Supply Chain Attacks

npm Malware Outbreak: Tinycolor and CrowdStrike Packages Compromised

Endor Labs Drives 225% Revenue Growth, Pioneers the Future of Secure SDLC

Major Supply Chain Attack Compromises Popular npm Packages Including chalk and debug

Nx build platform compromised by supply chain attack – How attackers collude with AI code assistants

How We Cracked SCA for C/C++ Codebases

Cursor Develops a Secure Product with Endor Labs

When CodeRabbit became PwnedRabbit: A cautionary tale for every GitHub App vendor (and their customers)

Shadow AI in Your Codebase: A Hidden Supply Chain Risk

Five9 Transforms Software Supply Chain Security with Endor Labs

Under the Hood: How I Vet Early-Stage Startups for Critical Security Programs

Detect End-of-Life (EOL) Software in Containers with Endor Labs

The Most Common Security Vulnerabilities in AI-Generated Code

The Last Mile of AI Productivity Is Code Review

Fireside Chat: CISOs on AI, Shift Left, and Building Trust at People.ai and AppLovin

Fireside Chat: Building a High-Trust Product Security Program at Zebra

How to Detect LLM Prompt Injection Risks

Why Your AI Code Assistant Might Be Shipping CVEs

Anti-Pattern Avoidance: A Simple Prompt Pattern for Safer AI-Generated Code

Endor Labs now integrates with GitHub Copilot in VS Code

Securing AI Coding Assistants: A Total Cost Analysis

Endor Labs Now Available on Google Cloud Marketplace

How to Detect Infrastructure as Code (IaC) Misconfigurations with AI Security Code Review

Endor Labs now integrates with Cursor AI Code Editor

Secure-Insecure Diff: A Smarter Way to Prompt for Safer Code

How to Evaluate Endor Labs SCA for C/C++ Projects

CVE-2025-54313: eslint-config-prettier Compromise — High Severity but Windows-Only

Everything You Need To Know About The FedRAMP RFC-0012

Structuring Prompts for Secure Code Generation

Endor Outpost: Deploy Endor Labs Behind Your Firewall

Endor Labs & Oligo: Closing the Loop Between Secure Code and Secure Runtime

Struggling to Patch Spring-Web? Try This Instead

Under the Hood: People.ai's Proactive Approach to AI Security

People.ai Transforms Security and Compliance with Endor Labs

Streamline Investigation with Enriched Vulnerability Search

What is AppSec? A 2025 Guide for Security Practitioners

Cracking the Code: Solving the Challenges of C/C++ Software Composition Analysis

Mysten Labs Improves DevEx with Endor Labs

Under the Hood: Mysten Labs’ Strategies for Building the Most Secure Blockchain

Zebra Technologies Cuts SCA Noise by 97% with Endor Labs

Next-Gen SCA for C/C++: Closing the Detection Gap

Critical SQL Injection Vulnerability in LlamaIndex (CVE-2025-1793) – Advisory and Analysis

AppSec’s Exploitation Era: What Verizon, Mandiant, and Datadog Are Telling Us

Benchmarking Opengrep Performance Improvements

The UK Software Security Code of Practice through a Software Supply Chain Lens

CVE-2025-47949 Reveals Flaw in samlify That Opens Door to SAML Single Sign-On Bypass

Endor Labs Policies: Developer-Friendly Security Automation

CVE-2025-4641 is Critical, But Likely Unreachable

Mastering Security Automation: Exception and Remediation Policies

5 Tips for Managing Bazel Dependencies (Without Losing Friends)

Why Security Policies Frustrate Developers (and How We Can Fix Them)

Open Source Gets Political: What The easyjson Debate Misses (and what to do about it)

Why We Raised a $93M Series B (In This Market)

Secure AI-Generated Code at the Source

AI Security Code Review: A Multi-Agent Approach for Detecting Security Design Flaws at Scale

Introducing the Endor Labs MCP Server: fix-first security for the vibe coding era

Introducing AI Security Code Review

Meet the application security platform built for the AI era

Critical RCE Vulnerability in Apache Parquet (CVE-2025-30065) – Advisory and Analysis

Reducing Noise and Fixing What Matters

OWASP OSS Risk 2: Compromise of Legitimate Package

Blast Radius of the tj-actions/changed-files Supply Chain Attack

What You Need to Know About UK Cyber Essentials Certification

GitHub Action tj-actions/changed-files supply chain attack: what you need to know

Application Security Posture Management (ASPM) Explained

How Endor Patches Are Built and Tested

The AppSec Maturity Staircase: Climbing Faster, Not Harder with Endor Labs

How to Get Developers to Accept Security PRs Faster

DeepSeek R1: What Security Teams Need to Know

How to Discover Open Source AI Models in Your Code

Remote Code Execution Vulnerabilities in Apache Struts

Everything You Need to Know About Opengrep

Uncover Trends and Show AppSec Value with the Endor Labs Dashboard

Identifying and Tracking FedRAMP False Positives

How Endor Labs Prioritizes Open Source Security Patches

Why Reachability Analysis for JavaScript Is Hard (and How We Fixed It)

Endor Patches Whitepaper

Grip Security Reduces Noise by 99%

Under the Hood: Grip Security Builds Customer Trust with AppSec

The Uncomfortable Truth of Vulnerable and Outdated Software Components

Reduce FedRAMP Compliance Costs

Why OVAL Feeds Outperform NVD for Linux Vulnerability Management

Achieving FedRAMP’s Container Scanning Requirements

Breaking Changes, Breaking Trust