Legit Security Blog

Legitify adds support for GitLab and GitHub Enterprise Server

Roy Blit : Jan 25, 2023 3:09:07 PM

We encounter security incidents on a weekly basis with prospective customers that involve pipeline manipulation, code theft, and sensitive data...

1 min read

The MarkdownTime Vulnerability: How to Avoid This DoS Attack on Business Critical Services

Tor Beer : Jan 18, 2023 5:43:00 AM

Everybody is familiar with downtimes in major services. It can be very frustrating when a platform your organization depends upon becomes...

2023 Predictions for Modern Application Security

Liav Caspi : Jan 9, 2023 10:23:37 AM

Software dominates the world and remains abig and accessible attack surface.In 2022, an estimated $6Bwas invested in Application Security, with that...

How to Continuously Detect Vulnerable Jenkins Plugins to Avoid a Software Supply Chain Attack

Nadav Noy : Jan 4, 2023 6:21:15 AM

Jenkins is an open-source automation and build platform that allows for automated tests, integrations, builds, and much more. However, Jenkins also...

Introducing Legitify: A Better Way To Secure GitHub

Roy Blit : Oct 5, 2022 8:07:38 AM

We’re pleased to announce the launch of Legitify – an open-source security tool for GitHub users to automatically discover and remediate insecure...

Google & Apache Found Vulnerable to GitHub Environment Injection

Noam Dotan : Sep 1, 2022 10:00:03 AM

In this blog post, we'll discuss a new type of GitHub Actions workflow vulnerability we called "GitHub Environment Injection". We've found a couple of

The Open Source Community And Its Critical Role in Software Supply Chain Security

Liav Caspi : Jun 13, 2022 7:57:25 AM

As we head to the Open Source Summit conference next week, we wanted to discuss our contributions to the open source community, why we invest so much...

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

Noam Dotan : May 2, 2022 10:44:09 AM

In this blog post, we’ll explore a bug we’ve found in a popular third-party action and how in some cases it could lead to your SDLC pipeline being...

Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline

Noam Dotan : Apr 4, 2022 3:01:54 PM

At Legit Security, we’re focused on preventing software supply chain attacks and securing the SDLC for our customers and the broader cybersecurity...

Announcing Legit Security: The Story Behind Our Mission

Roni Fuchs : Jan 28, 2022 11:48:00 AM

I'm excited to share that Legit Security is officially launching out of stealth mode. While in stealth, we’ve been incredibly busy acquiring our...