Developer security
SSH keys, API tokens, .env files and poisoned packages: protecting a developer machine from supply chain attacks.
Shai-Hulud worm: am I affected, and how to clean up
The Shai-Hulud worm steals npm, GitHub and cloud tokens and republishes your own packages. Check if you are affected, clean up safely and stop the next wave.
AI coding assistant security risks: Cursor, Claude, Copilot
AI coding assistant security risks: how poisoned repos, rules files and fake packages turn Cursor, Claude Code or Copilot on you, and how to lock them down.
How to check if an npm package is safe before you install
How to check if an npm package is safe in 5 minutes: spot typosquats, brand-new versions, install scripts and fake provenance before npm install runs a thing.
Are MCP servers safe? How to vet one before you add it
Are MCP servers safe? Each one is a program running with your permissions. Real malicious MCP cases, tool poisoning, and how to vet a server first.
Is curl pipe bash safe? How to check before you run it
Is curl pipe bash safe? Only as safe as the page you copied it from and the server it names. How to read, verify and run an install script, and when to skip it.
Protect against npm supply chain attacks: what to change
Protect against npm supply chain attacks: how they hide in install scripts and hijacked packages like axios, and the npm settings that shut them out.
Protect Claude Code: is it safe, and how to lock it down
How to protect Claude Code, which runs commands as you: permission modes, the sandbox, poisoned repo files, its CVEs, and the settings to change today.