Building a browser extension? Be careful not to XSS the whole internet
Software and Application Security Blog | Black Duck

    
    


        
        
            
                

    
    
  
    
      
		
			
				[NEW] Insights from the 2024 Global State of DevSecOps report
			
		       
      
    
    
      By Fred Bals

    
     
      Read more
    
    
  
  
  
    
    
      
      
	
		
		
	
	
    


    
    
      
  
  


  
            
        
            
                

    
    
  
    
      
		
			
				[NEW] Addressing cloud-native app development challenges with scalable security tools
			
		       
      
    
    
      By Charlotte Freeman

    
     
      Read more
    
    
  
  
  
    
    
      
      
	
		
		
	
	
    


    
    
      
  
  


  
            
        
            
                

    
    
  
    
      
		
			
				[NEW] Black Duck takes flight
			
		       
      
    
    
      By Jason Schmitt

    
     
      Read more
    
    
  
  
  
    
    
      
      
	
		
		
	
	
    


    
    
      
  
  


  
            
        
    




        
            Most recent

        
    

      
          
            
              
                
                  
                
              
            
          
          

            
              
                Major changes and challenges of PCI DSS 4.0
              
            

            
              
                
                  
                
              
              
                By
                
                  John Waller
              
              
            

            
              
                Nov 04, 2024
                /
              
              
                6 min read
              
            

            Tags:
              
                Financial Services, 
              
                Compliance, 
              
                Security Consulting and Services
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Understanding generative AI risks in software development
              
            

            
              
                
                  
                
              
              
                By
                
                  Phil Odence
              
              
            

            
              
                Oct 24, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                M&A, 
              
                SCA, 
              
                Secure the Software Supply Chain, 
              
                Software Supply Chain Security, 
              
                OSS License Compliance, 
              
                Security Consulting and Services
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Addressing cloud-native app development challenges with scalable security tools
              
            

            
              
                
                  
                
              
              
                By
                
                  Charlotte Freeman
              
              
            

            
              
                Oct 17, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                DAST, 
              
                SCA, 
              
                DevSecOps, 
              
                SAST
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Faster, better, stronger application security for developers in the IDE
              
            

            
              
                
                  
                
              
              
                By
                
                  Steven Zimmerman
              
              
            

            
              
                Oct 10, 2024
                /
              
              
                6 min read
              
            

            Tags:
              
                SCA, 
              
                Build Security into DevOps, 
              
                SAST, 
              
                DevSecOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Key insights from Black Duck’s 2024 Global State of DevSecOps report
              
            

            
              
                
                  
                
              
              
                By
                
                  Fred Bals
              
              
            

            
              
                Oct 08, 2024
                /
              
              
                5 min read
              
            

            Tags:
              
                Security News & Trends, 
              
                DevSecOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Black Duck takes flight
              
            

            
              
                
                  
                
              
              
                By
                
                  Jason Schmitt
              
              
            

            
              
                Oct 01, 2024
                /
              
              
                2 min read
              
            

            Tags:
              
                Security News & Trends
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                A new identity for the Synopsys Software Integrity Group
              
            

            
              
                
                  
                
              
              
                By
                
                  Jason Schmitt
              
              
            

            
              
                Aug 12, 2024
                /
              
              
                2 min read
              
            

            Tags:
              
                Security News & Trends
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Once and future code snippets: How AI reignites risk
              
            

            
              
                
                  
                
              
              
                By
                
                  Phil Odence
              
              
            

            
              
                Jul 24, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                M&A, 
              
                SCA, 
              
                Secure the Software Supply Chain
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Why penetration testing needs to be part of your IoT security
              
            

            
              
                
                  
                
              
              
                By
                
                  Debrup Ghosh
              
              
            

            
              
                Jul 16, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                Build Security into DevOps, 
              
                Pen Testing
              
            

          
        
    



    
    
  
        
            Manage Security Risks

        
    
  
  
            See all manage security risks posts

        


  

      
          
            
              
                
                  
                
              
            
          
          

            
              
                A pragmatic guide to getting started with ASPM
              
            

            
              
                
                  
                
              
              
                By
                
                  Rod Musser
              
              
            

            
              
                Jul 09, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                Manage Security Risks, 
              
                Orchestration & Correlation
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                SSDF BSIMM mapping updated for BSIMM14
              
            

            
              
                
                  
                
              
              
                By
                
                  Mike Lyman
              
              
            

            
              
                Jun 18, 2024
                /
              
              
                8 min read
              
            

            Tags:
              
                Program Strategy & Planning, 
              
                Compliance, 
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Solving telecom network security challenges with Defensics
              
            

            
              
                AP
                
              
              
                By
                
                  Andy Pan
              
              
            

            
              
                Apr 15, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                Mobile, 
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Top 10 free pen tester tools
              
            

            
              
                
                  
                
              
              
                By
                
                  Natalie Lightner
              
              
            

            
              
                Apr 11, 2024
                /
              
              
                5 min read
              
            

            Tags:
              
                Security News & Trends, 
              
                Pen Testing, 
              
                Web AppSec, 
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Managing risk at scale
              
            

            
              
                
                  
                
              
              
                By
                
                  Charlotte Freeman
              
              
            

            
              
                Apr 08, 2024
                /
              
              
                2 min read
              
            

            Tags:
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                SANS report: Securing the shifting landscape of application development
              
            

            
              
                
                  
                
              
              
                By
                
                  Charlotte Freeman
              
              
            

            
              
                Apr 03, 2024
                /
              
              
                2 min read
              
            

            Tags:
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Guide to updating from NIST CSF 1.1 to 2.0
              
            

            
              
                
                  
                
              
              
                By
                
                  John Waller
              
              
            

            
              
                Mar 29, 2024
                /
              
              
                7 min read
              
            

            Tags:
              
                Cloud Security, 
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                4 approaches to vulnerability remediation
              
            

            
              
                
                  
                
              
              
                By
                
                  Natalie Lightner
              
              
            

            
              
                Mar 27, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                SCA, 
              
                Build Security into DevOps, 
              
                Training, 
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                2024 OSSRA report: Open source license compliance remains problematic
              
            

            
              
                
                  
                
              
              
                By
                
                  Fred Bals
              
              
            

            
              
                Mar 19, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                Artificial Intelligence, 
              
                Manage Security Risks, 
              
                OSS License Compliance
              
            

          
        
    
 
      See all posts
    



    
    
  
        
            Build Security into DevOps

        
    
  
  
            See all build security into DevOps posts

        


  

      
          
            
              
                
                  
                
              
            
          
          

            
              
                Faster, better, stronger application security for developers in the IDE
              
            

            
              
                
                  
                
              
              
                By
                
                  Steven Zimmerman
              
              
            

            
              
                Oct 10, 2024
                /
              
              
                6 min read
              
            

            Tags:
              
                SCA, 
              
                Build Security into DevOps, 
              
                SAST, 
              
                DevSecOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Why penetration testing needs to be part of your IoT security
              
            

            
              
                
                  
                
              
              
                By
                
                  Debrup Ghosh
              
              
            

            
              
                Jul 16, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                Build Security into DevOps, 
              
                Pen Testing
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Accelerate application code fixes with AI-powered Polaris Assist 
              
            

            
              
                
                  
                
              
              
                By
                
                  Corey Hamilton
              
              
            

            
              
                Apr 29, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                Artificial Intelligence, 
              
                Security News & Trends, 
              
                Build Security into DevOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Understanding Python pickling and how to use it securely
              
            

            
              
                
                  
                
              
              
                By
                
                  Ashutosh Agrawal
              
              
            

            
              
                Apr 17, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                Build Security into DevOps, 
              
                Training
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                How to detect, prevent, and mitigate buffer overflow attacks
              
            

            
              
                
                  
                
              
              
                By
                
                  Natalie Lightner
              
              
            

            
              
                Mar 31, 2024
                /
              
              
                8 min read
              
            

            Tags:
              
                Build Security into DevOps, 
              
                SAST
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                4 approaches to vulnerability remediation
              
            

            
              
                
                  
                
              
              
                By
                
                  Natalie Lightner
              
              
            

            
              
                Mar 27, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                SCA, 
              
                Build Security into DevOps, 
              
                Training, 
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Top 4 software development methodologies
              
            

            
              
                
                  
                
              
              
                By
                
                  Mike McGuire
              
              
            

            
              
                Mar 24, 2024
                /
              
              
                5 min read
              
            

            Tags:
              
                Agile, CI/CD, 
              
                Build Security into DevOps, 
              
                DevSecOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Introducing fAST Dynamic: Streamlining dynamic application security testing
              
            

            
              
                
                  
                
              
              
                By
                
                  Vishrut Iyengar
              
              
            

            
              
                Mar 19, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                DAST, 
              
                Security News & Trends, 
              
                Build Security into DevOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Six Python security best practices for developers
              
            

            
              
                
                  
                
              
              
                By
                
                  Boris Cipot
              
              
            

            
              
                Mar 18, 2024
                /
              
              
                8 min read
              
            

            Tags:
              
                Build Security into DevOps, 
              
                AppSec Best Practices, 
              
                Training
              
            

          
        
    
 
      See all posts
    



    
    
  
        
            Secure the Software Supply Chain

        
    
  
  
            See all secure the software supply chain posts

        


  

      
          
            
              
                
                  
                
              
            
          
          

            
              
                Understanding generative AI risks in software development
              
            

            
              
                
                  
                
              
              
                By
                
                  Phil Odence
              
              
            

            
              
                Oct 24, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                M&A, 
              
                SCA, 
              
                Secure the Software Supply Chain, 
              
                Software Supply Chain Security, 
              
                OSS License Compliance, 
              
                Security Consulting and Services
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Once and future code snippets: How AI reignites risk
              
            

            
              
                
                  
                
              
              
                By
                
                  Phil Odence
              
              
            

            
              
                Jul 24, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                M&A, 
              
                SCA, 
              
                Secure the Software Supply Chain
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Is AI-generated code secure? Maybe. Maybe not.
              
            

            
              
                
                  
                
              
              
                By
                
                  Patrick Carey
              
              
            

            
              
                Jun 12, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                Artificial Intelligence, 
              
                Secure the Software Supply Chain, 
              
                Software Supply Chain Security, 
              
                Securing the Software Supply Chain
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                The changing face of software supply chain security risk
              
            

            
              
                
                  
                
              
              
                By
                
                  Fred Bals
              
              
            

            
              
                May 16, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                SCA, 
              
                Secure the Software Supply Chain
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Building a software Bill of Materials with Black Duck
              
            

            
              
                
                  
                
              
              
                By
                
                  Mike McGuire
              
              
            

            
              
                Apr 20, 2024
                /
              
              
                5 min read
              
            

            Tags:
              
                SCA, 
              
                Secure the Software Supply Chain, 
              
                Compliance
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Securing the software supply chain with Black Duck Supply Chain Edition
              
            

            
              
                
                  
                
              
              
                By
                
                  Mike McGuire
              
              
            

            
              
                Apr 09, 2024
                /
              
              
                4 min read
              
            

            Tags:
              
                SCA, 
              
                Secure the Software Supply Chain
              
            

          
        
    
 
      See all posts
    



    
    
  
        
            Security News & Trends

        
    
  
  
            See all security news & trends posts

        


  

      
          
            
              
                
                  
                
              
            
          
          

            
              
                Key insights from Black Duck’s 2024 Global State of DevSecOps report
              
            

            
              
                
                  
                
              
              
                By
                
                  Fred Bals
              
              
            

            
              
                Oct 08, 2024
                /
              
              
                5 min read
              
            

            Tags:
              
                Security News & Trends, 
              
                DevSecOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Black Duck takes flight
              
            

            
              
                
                  
                
              
              
                By
                
                  Jason Schmitt
              
              
            

            
              
                Oct 01, 2024
                /
              
              
                2 min read
              
            

            Tags:
              
                Security News & Trends
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                A new identity for the Synopsys Software Integrity Group
              
            

            
              
                
                  
                
              
              
                By
                
                  Jason Schmitt
              
              
            

            
              
                Aug 12, 2024
                /
              
              
                2 min read
              
            

            Tags:
              
                Security News & Trends
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                CyRC Vulnerability Advisory: CVE-2024-5184s prompt injection in EmailGPT service
              
            

            
              
                
                  
                
              
              
                By
                
                  Mohammed Alshehri
              
              
            

            
              
                Jun 04, 2024
                /
              
              
                1 min read
              
            

            Tags:
              
                Security News & Trends, 
              
                CyRC
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                CyRC Vulnerability Advisory: CVE-2024-5185 Data Poisoning Vulnerability in EmbedAI Application
              
            

            
              
                
                  
                
              
              
                By
                
                  Mohammed Alshehri
              
              
            

            
              
                May 27, 2024
                /
              
              
                1 min read
              
            

            Tags:
              
                Security News & Trends, 
              
                CyRC
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Clearlake Capital Group and Francisco Partners reach agreement to purchase the Software Integrity Group
              
            

            
              
                
                  
                
              
              
                By
                
                  Jason Schmitt
              
              
            

            
              
                May 08, 2024
                /
              
              
                1 min read
              
            

            Tags:
              
                Security News & Trends
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Accelerate application code fixes with AI-powered Polaris Assist 
              
            

            
              
                
                  
                
              
              
                By
                
                  Corey Hamilton
              
              
            

            
              
                Apr 29, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                Artificial Intelligence, 
              
                Security News & Trends, 
              
                Build Security into DevOps
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Top 10 free pen tester tools
              
            

            
              
                
                  
                
              
              
                By
                
                  Natalie Lightner
              
              
            

            
              
                Apr 11, 2024
                /
              
              
                5 min read
              
            

            Tags:
              
                Security News & Trends, 
              
                Pen Testing, 
              
                Web AppSec, 
              
                Manage Security Risks
              
            

          
        
    
      
          
            
              
                
                  
                
              
            
          
          

            
              
                Introducing fAST Dynamic: Streamlining dynamic application security testing
              
            

            
              
                
                  
                
              
              
                By
                
                  Vishrut Iyengar
              
              
            

            
              
                Mar 19, 2024
                /
              
              
                3 min read
              
            

            Tags:
              
                DAST, 
              
                Security News & Trends, 
              
                Build Security into DevOps
              
            

          
        
    
 
      See all blog posts
    

    
    
    
      
		
			
				Explore Topics
			
		       
      
    
    
    
    
  


	
		
			Agile, CI/CD
		
	
	
		
			AppSec Best Practices
		
	

		
			Artificial Intelligence
		
	

	
		
			Automotive
		
	

	
		
			Build Security into DevOps
		
	
	
	
		
			Cloud Security
		
		
	
		
			Compliance
		
	
	
		
			Container Security
		
	
	
	
		
			CyRC
		
	
	
	
		
			DevSecOps
		
	
	
	
		
			DAST
			
	
	
	
		
			Financial Services
		
	
	
	
		
			Fuzzing
		
	
	
	
		
			Healthcare
		
	
	
	
		
			IAST
		
	
	
	
		
			Internet of Things
		
	
		
		
			M&A
		
	
	
	
		
		Manage Security Risks
		
	
	
	
		
			Medical Devices
		
	
	
	
		
			Mobile
		
	
	
		
			Orchestration & Correlation
		
	
	
	
		
			OSS License Compliance
		
	
	
		
			Pen Testing
		
	
	
		
			Program Strategy & Planning
		
	
	
		
			Public Sector
		
	

		
		
			SAST
		
	


		
			SCA
		
	
	
		
			Secure the Software Supply Chain
		
	

	
		
			Security News & Trends
		
	
	
		
			Threat Modeling
		
	
		
			Threat & Risk Assessment
		
	
	
		
			Training
		
	
	
		
			Web Application Security
		
	



    


    
    
                            
                                
                                    Application Security Blog
                                
                                
                                
                                
                                
                                
                            
                            
                            Subscribe to our newsletter for the latest application security news, best practices, and trends. 
                        



    


    
