Blogs about Legit

Explainers Best Practices AppSec Legit Threats

Securing the Software Supply Chain: Risk Management Tips

April 01, 2024

Securing the Software Supply Chain: Risk Management Tips. Securing the software supply chain can seem daunting, but with the right strategy, you can optimize your software supply chain risk management practices.

AppSec Legit Threats

What You Need to Know About the XZ Utils Backdoor

March 30, 2024

What You Need to Know About the XZ Utils Backdoor.

Best Practices AppSec Legit Threats

How to Get the Most From Your Secrets Scanning

March 25, 2024

How to Get the Most From Your Secrets Scanning. Secret scanning is essential for unlocking next-level software supply chain security. Get tips & best practices for optimal secret scanning to secure your code.

Best Practices AppSec Legit Threats

Microsoft Under Attack by Russian Cyberattackers

March 15, 2024

Microsoft Under Attack by Russian Cyberattackers. Understand how these attackers are operating and what their tactics mean for security strategies.

Best Practices AppSec Legit

Using AI to Reduce False Positives in Secrets Scanners

March 11, 2024

Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is reducing secret-scanning false positives..

The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious code and access secrets.

AppSec Legit Threats SCMs

Azure Devops Zero-Click CI/CD Vulnerability

January 31, 2024

The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious code and access secrets.

Legit

Looking back on a Legit 2023

January 10, 2024

Reflections on a Legit 2023 and why we're excited as we look ahead to the new year.

Legit Security | Uncovering 'AIJacking': How Attackers Exploit Hugging Face for AI Supply Chain Attacks - A Deep Dive into Vulnerabilities and Risks.

Legit Threats

Legit Discovers "AI Jacking" Vulnerability in Popular Hugging Face AI Platform

October 24, 2023

Uncovering 'AIJacking': How Attackers Exploit Hugging Face for AI Supply Chain Attacks - A Deep Dive into Vulnerabilities and Risks.

Legit Security | Explore Legit Security's revolutionary AI application security, risks, and solutions in our blog.

Explainers Legit

Securing AI-Generated Code

September 18, 2023

Explore Legit Security's revolutionary AI application security, risks, and solutions in our blog.

Legit

OpenSSF SCM Best Practices Guide Released With Contributions From Legitify

September 13, 2023

Explore the collaborative effort by OpenSSF and leading security vendors in the release of SCM Best Practices Guide.

Legit Security | Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

AppSec Legit Partners

Legit Security and CrowdStrike: Securing Applications from Code Creation to Cloud Deployment

August 29, 2023

Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

AppSec Legit

Legit Security ASPM Platform Update: Accelerating AppSec Efficiency and Effectiveness

August 21, 2023

Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

Legit Security | This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

Legit Threats

How We Found Another GitHub Actions Environment Injection Vulnerability in a Google Project

July 03, 2023

This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

Legit Security | This blog analyzes trends in application security and predicts the future direction of enterprise application security programs.

CISO Best Practices Legit

2023 Predictions for Modern Application Security

July 03, 2023

This blog analyzes trends in application security and predicts the future direction of enterprise application security programs.

Legit Security | Get insights into the elements of ASPM to learn how this approach transforms AppSec and enables teams to deliver securely at scale.

Explainers AppSec Legit

What is Application Security Posture Management – Insights Into Gartner’s® New Report

May 15, 2023

Get insights into the elements of ASPM to learn how this approach transforms AppSec and enables teams to deliver securely at scale.

Legitify is an open-source GitHub and GitLab configuration scanner from Legit Security that helps manage & enforce SCM configuration best practices in a secure and scalable way

Legit SCMs

Legitify adds support for GitLab and GitHub Enterprise Server

January 25, 2023

Legitify is an open-source GitHub and GitLab configuration scanner from Legit Security that helps manage & enforce SCM configuration best practices in a secure and scalable way

We explore our findings in a popular implementation vulnerability of the markdown engine and potential Denial-of-Service (DoS) attack that it could cause.

Legit Threats

The MarkdownTime Vulnerability: How to Avoid This DoS Attack on Business Critical Services

January 18, 2023

We explore our findings in a popular implementation vulnerability of the markdown engine and potential Denial-of-Service (DoS) attack that it could cause.

See how attackers used compromised Jenkins plugins to attack the software supply chain and how to continuously detect vulnerable Jenkins plugins at scale.

Best Practices Legit Threats

How to Continuously Detect Vulnerable Jenkins Plugins to Avoid a Software Supply Chain Attack

January 04, 2023

See how attackers used compromised Jenkins plugins to attack the software supply chain and how to continuously detect vulnerable Jenkins plugins at scale.

Legitify is an open-source GitHub configuration scanner from Legit Security that helps manage & enforce GitHub configurations in a secure and scalable way

Legit SCMs

Introducing Legitify: A Better Way To Secure GitHub

October 05, 2022

Legitify is an open-source GitHub configuration scanner from Legit Security that helps manage & enforce GitHub configurations in a secure and scalable way

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

Legit Threats SCMs

Google & Apache Found Vulnerable to GitHub Environment Injection

September 01, 2022

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

A review of our contributions to the open source community and why the open source community is important to the future of software supply chain security.

Legit

The Open Source Community And Its Critical Role in Software Supply Chain Security

June 13, 2022

A review of our contributions to the open source community and why the open source community is important to the future of software supply chain security.

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Best Practices Legit Threats SCMs

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

May 02, 2022

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Learn how Legit Security discovered a vulnerable GitHub actions workflow. Get details on the vulnerability and and what you can do to mitigate it.

Best Practices Legit Threats SCMs

Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline

April 04, 2022

Learn how Legit Security discovered a vulnerable GitHub actions workflow. Get details on the vulnerability and and what you can do to mitigate it.

Join us in celebrating the release of stealth mode.

CISO AppSec Legit

Announcing Legit Security: The Story Behind Our Mission

January 28, 2022

Join us in celebrating the release of stealth mode.

Blogs about Legit

Topic

Sign up for our newsletter

Securing the Software Supply Chain: Risk Management Tips

What You Need to Know About the XZ Utils Backdoor

How to Get the Most From Your Secrets Scanning

Microsoft Under Attack by Russian Cyberattackers

Using AI to Reduce False Positives in Secrets Scanners

Azure Devops Zero-Click CI/CD Vulnerability

Looking back on a Legit 2023

Legit Discovers "AI Jacking" Vulnerability in Popular Hugging Face AI Platform

Securing AI-Generated Code

OpenSSF SCM Best Practices Guide Released With Contributions From Legitify

Legit Security and CrowdStrike: Securing Applications from Code Creation to Cloud Deployment

Legit Security ASPM Platform Update: Accelerating AppSec Efficiency and Effectiveness

How We Found Another GitHub Actions Environment Injection Vulnerability in a Google Project

2023 Predictions for Modern Application Security

What is Application Security Posture Management – Insights Into Gartner’s® New Report

Legitify adds support for GitLab and GitHub Enterprise Server

The MarkdownTime Vulnerability: How to Avoid This DoS Attack on Business Critical Services

How to Continuously Detect Vulnerable Jenkins Plugins to Avoid a Software Supply Chain Attack

Introducing Legitify: A Better Way To Secure GitHub

Google & Apache Found Vulnerable to GitHub Environment Injection

The Open Source Community And Its Critical Role in Software Supply Chain Security

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline

Announcing Legit Security: The Story Behind Our Mission

Request a Demo