The Shai-Hulud worm has hit npm in waves since September 2025, and most infections ran in CI. Here is what each wave did, why lockfiles don't settle whether you were affected, and how to find out.
Every GitHub Actions job gets a GITHUB_TOKEN, and on older repositories it can still write to almost everything. Here is how the permissions key works, what each job actually needs, and how to find the minimum.
Masking, fork rules and environments protect GitHub Actions secrets less than most teams assume. Here is how secrets actually leak from workflows, and the controls that stop each route.
When a critical CVE drops, the first question is whether your products contain the vulnerable component, and since when. Here is how companies answer it, where the usual methods fall short, and what a build history adds.