Blog

Authors

Noam Dotan

Noam Dotan

Showing all posts by Noam Dotan

Using AI to Reduce False Positives in Secrets Scanners

March 11, 2024

Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is reducing secret-scanning false positives..

Gain insights into GenAI applications and how they represent an innovative category of technology, leveraging Large Language Models (LLMs) at their core.

AppSec

GenAI-Based Application Security 101

February 13, 2024

Gain insights into GenAI applications and how they represent an innovative category of technology, leveraging Large Language Models (LLMs) at their core.

Legit

OpenSSF SCM Best Practices Guide Released With Contributions From Legitify

September 13, 2023

Explore the collaborative effort by OpenSSF and leading security vendors in the release of SCM Best Practices Guide.

Legit Security | Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

AppSec Legit Partners

Legit Security and CrowdStrike: Securing Applications from Code Creation to Cloud Deployment

August 29, 2023

Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

Legit Security | This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

Legit Threats

How We Found Another GitHub Actions Environment Injection Vulnerability in a Google Project

July 03, 2023

This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

Threats SCMs

Novel Pipeline Vulnerability Discovered; Rust Found Vulnerable

December 01, 2022

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

Best Practices SCMs

GitHub Codespaces Security Best Practices

September 28, 2022

GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Threats SCMs

Attackers Can Bypass GitHub Required Reviewers to Submit Malicious Code

September 08, 2022

GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

Legit Threats SCMs

Google & Apache Found Vulnerable to GitHub Environment Injection

September 01, 2022

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

LastPass disclosed that an unauthorized party had gained access to portions of the LastPass developer environment. An attacker gained access to developer account credentials and used them to exfiltrate portions of their proprietary source code.

Best Practices Threats

LastPass Software Supply Chain Attack: What Happened and Tips to Protect Against Similar Attacks

August 29, 2022

LastPass disclosed that an unauthorized party had gained access to portions of the LastPass developer environment. An attacker gained access to developer account credentials and used them to exfiltrate portions of their proprietary source code.

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Best Practices Legit Threats SCMs

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

May 02, 2022

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Learn how Legit Security discovered a vulnerable GitHub actions workflow. Get details on the vulnerability and and what you can do to mitigate it.