Aikido
Start for Free
No CC required

Welcome to our blog.

Featured
Cronos Group chooses Aikido Security to strengthen security posture for its companies and customers
Aikido to strengthen Cronos Group security posture
The Cronos Group chooses Aikido Security to strengthen its security posture. As a reseller, The Cronos Group will offer Aikido to its clients.
The Cronos Group chooses Aikido Security to strengthen its security posture. Aikido's Partner Portal gives The Cronos Group a central overview of the companies in their group. Additionally, as a reseller, The Cronos Group will offer Aikido to its clients.
Customer Stories
How Loctax uses Aikido Security to get rid of irrelevant security alerts & false positives
Loctax gets rid of false positives with Aikido Security
Loctax optimizes its security posture with Aikido Security to decrease false positives & irrelevant security alerts, harmonize workflows, and reduce costs.
By embracing Aikido Security's solutions, Loctax optimized its security posture, including getting rid of false positives. This has saved precious time each month and achieved remarkable cost efficiencies.
Customer Stories
Aikido Security raises €5m to offer a seamless security solution to growing SaaS businesses
Aikido Security Raises €5m for SaaS Security Solution
Aikido Security, the developer-first software security app for SaaS companies, announces it has raised €5m in a Seed round co-led by Notion Capital.
Product & Company Updates
Aikido Security achieves ISO 27001:2022 compliance
Aikido Security achieves ISO 27001:2022 compliance
Aikido Security achieves ISO 27001:2022 compliance
Product & Company Updates
How StoryChief’s CTO uses Aikido Security to sleep better at night
Startup security: StoryChief uses Aikido to sleep better
StoryChief optimizes its security posture with Aikido Security. Startup security that is affordable, reduces false positives and gives CTOs peace of mind.
Losing sleep over startup security concerns? Discover how Aikido Security improved StoryChief's security posture, providing peace of mind and better sleep for the CTO.
Customer Stories
What is a CVE?
What is a CVE?
What is a CVE? Common vulnerabilities and exposures database inform devs and security teams about past threats. CVSS scores report the severity of a CVE.
What is a CVE? MITRE's Common Vulnerabilities and Exposures database informs developers and security teams about past threats. CVSS scores report the severity of a CVE. CWE (Common Weakness Enumeration) provides useful info on weaknesses that might result in vulnerabilities. Aikido Security provides risk scores that build on the CVE's CVSS scores.
Vulnerabilities & Threats
Top 3 web application security vulnerabilities in 2024
Top 3 web application security vulnerabilities in 2024
Learn about the most common and critical web application security vulnerabilities in 2024. Covers SAST, DAST, and CSPM vulnerabilities. And how to fix them.
Vulnerabilities & Threats
New Aikido Security Features: August 2023
New Aikido Security Features: August 2023
August 2023: Aikido has released lots of new features and expanded support for different tool stacks. Our reachability engine now fully supports PNPM!
In the last few weeks, we’ve released many new features and expanded support for different tool stacks. We’ve upgraded our reachability engine to fully support PNPM, expanded AWS rules, pointed Autofix toward Python, and increased support for containers registries.
Product & Company Updates
Aikido’s 2024 SaaS CTO Security Checklist
SaaS CTO Security Checklist for 2024
Don't be an easy target for hackers! Find out how to secure your SaaS company and keep your code and app 10x more secure. Over 40 vulnerabilities and tips.
SaaS companies have a huge target painted on their backs when it comes to security. Aikido's 2024 SaaS CTO Security Checklist gives you over 40 items to enhance security 💪 Download it now and make your company and code 10x more secure. #cybersecurity #SaaSCTO #securitychecklist
Guides & Best Practices
15 Top Cloud and Code Security Challenges Revealed by CTOs
15 Top Cloud and Code Security Challenges Revealed by CTOs
We consulted 15 SaaS CTOs from cloud-native software companies about their cloud and code security concerns. Priorities, blockers, flaws, desired outcomes!
CTOs all face challenges in securing their product. We wanted to find the trends and discover the needs and concerns of SaaS CTOs. We consulted 15 CTOs from cloud-native software companies about their cloud and code security challenges. Priorities, blockers, flaws, desired outcomes!
Guides & Best Practices
Preventing prototype pollution in your repository
2 Simple Ways to Prevent Prototype Pollution
The Javascript ecosystem has a problem and it’s called prototype pollution. We recommend a solution called nopp, and we'll show you how to implement this.
Guides & Best Practices
What is OWASP Top 10?
OWASP Top 10: Easy Guide of the Top Security Risks
What is OWASP Top 10? Learn about the importance of the OWASP Top 10 in building a secure, compliant, and trustworthy web application.
The OWASP Top 10 serves as a vital checklist, identifying the most critical web application security risks and guiding developers in mitigating these vulnerabilities. By adhering to the OWASP Top 10, not only do you protect sensitive data, but you also foster a culture of security awareness, ensuring your application remains resilient in the face of emerging threats.
Vulnerabilities & Threats
How to build a secure admin panel for your SaaS app
How to build a secure admin panel for your SaaS app
Avoid common mistakes when building a SaaS admin panel. We outline some pitfalls and potential solutions specifically for SaaS builders!
Avoid common mistakes when building a SaaS admin panel. We outline some pitfalls and potential solutions specifically for SaaS builders!
Guides & Best Practices
How to prepare yourself for ISO 27001:2022
How to prepare yourself for ISO 27001:2022
ISO 27001:2022 replaces ISO 27001:2013. Aikido helps you quickly comply with the new security controls so you and your customers can sleep at night.
ISO 27001:2022 replaces ISO 27001:2013. Aikido helps you quickly comply with the new security controls so you and your customers can sleep at night. This blog post walks you through the new requirements and how Aikido supports you.
Guides
Preventing fallout from your CI/CD platform being hacked
Preventing fallout from your CI/CD platform being hacked
CI/CD is a prime target for hackers, so take steps that prevent fallout. Aikido Security identifies if your cloud is actively defending your CI/CD.
CI/CD is a prime target for hackers, so take steps that prevent fallout. Aikido Security identifies if your cloud is actively defending your CI/CD.
Guides
How to Close Deals Faster with a Security Assessment Report
How to Close Deals Faster with a Security Assessment Report
Aikido’s security assessment report enables startups to establish trust and credibility with leads and potential customers to close deals faster.
Guides & Best Practices
Automate Technical Vulnerability Management [SOC 2]
Automate Technical Vulnerability Management [SOC 2]
How to become compliant without imposing a heavy workload on your dev team
How to become compliant without imposing a heavy workload on your dev team
Guides
How does a SaaS startup CTO balance development speed and security?
SaaS Security for Startups: 7 Expert Tips By CTOs
As a CTO of multiple early-stage SaaS startups, I've learned some invaluable lessons on how to navigate the delicate dance between development speed and security.
Guides
Aikido Security raises €2 million pre-seed round to build a developer-first software security platform
Aikido Security Raises €2M Pre-Seed for Security Platform
Belgian SaaS startup Aikido Security has raised €2 million in pre-seed funding from angel investors who support its mission to simplify software security.
Belgian SaaS startup Aikido Security has raised €2 million in pre-seed funding from renowned angel investors who support its mission to simplify software security for developers.
Product & Company Updates
How a startup’s cloud got taken over by a simple form that sends emails
How a Hacker Gained Access to a Startup's Cloud by Email
This is the story of an attacker who gained access to a startup’s Amazon S3 buckets, environment variables, and various internal API secrets.
How a startup’s cloud got taken over by a simple form that sends an email
Engineering
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
December 17, 2025
•
Vulnerabilities & Threats

The Fork Awakens: Why GitHub’s Invisible Networks Break Package Security

A deep dive into a GitHub security flaw where forked commits let attackers spoof dependencies. Understand the commit SHA issue and why package managers need API-level protection.

#Software Supply Chain Security

#Malware

#open-source

#NPM

#Dependencies

December 4, 2025
•
Vulnerabilities & Threats

PromptPwnd: Prompt Injection Vulnerabilities in GitHub Actions Using AI Agents

AI-driven GitHub Actions expose new prompt-injection supply chain vulnerabilities.

#AI

#SAST

#Vulnerabilities

December 3, 2025
•
Vulnerabilities & Threats

Critical React & Next.js RCE Vulnerability (CVE-2025-55182): What You Need to Fix Now

Learn how CVE-2025-55182 and the related Next.js RCE affect React Server Components. See impact, affected versions, and how to fix. Aikido now detects both issues.

#Vulnerabilities

2026

2026 State of AI in Security & Development

Our new report captures the voices of 450 security leaders (CISOs or equivalent), developers, and AppSec engineers across Europe and the US. Together, they reveal how AI-generated code is already breaking things, how tool sprawl is making security worse, and how developer experience is directly tied to incident rates. This is where speed and safety collide in 2025.

Read more

Subscribe to our changelog.
No spam, guaranteed.

Customer Stories

See how teams like yours are using Aikido to simplify security and ship with confidence.

See all

Compliance

Stay ahead of audits with clear, dev-friendly guidance on SOC 2, ISO standards, GDPR, NIS, and more.

See all

Guides & Best Practices

Actionable tips, security workflows, and how-to guides to help you ship safer code faster.

See all

DevSec Tools & Comparisons

Deep dives and side-by-sides of the top tools in the AppSec and DevSecOps landscape.

See all

Vulnerabilities & Threats

Cut through the noise with real-world CVE breakdowns, malware analysis, exploits, and emerging risks.

See all

Product & Company Updates

What’s new at Aikido—from product launches to big security wins.

See all
Threat Modeling
Cyber Resilience Act
Triaging
AutoTriage
Pentesting
Bazel
Code Quality
OWASP
NIS2
Legaltech
fintech
RASP
End of Life
SQL Injections
DAST
cnapp
cspm
aspm
Infrastructure as a Code IaC
Network Security Monitoring
License Scanners
SBOM
Container Scanning
AppSec
Vulnerabilities
Software Supply Chain Security
API
Dependencies
Continuous Security Monitoring
DevSecOps
Vibe Coding
AI
NPM
autofix
Malware
Article
open-source
SCA
intel
SOC 2
usecase
Tools
SAST
Compliance
CircleCI
Codeship
IMDSv2
Cloud
IMDSv1
SSRF
AWS
The Fork Awakens: Why GitHub’s Invisible Networks Break Package Security
The Fork Awakens: Why GitHub’s Invisible Networks Break Package Security
A deep dive into a GitHub security flaw where forked commits let attackers spoof dependencies. Understand the commit SHA issue and why package managers need API-level protection.
Vulnerabilities & Threats
SAST in the IDE is now free: Moving SAST to where development actually happens
Free SAST Scanning in Your IDE
Run free SAST scans directly in your IDE with real-time feedback and project-wide visibility. Use the same SAST rules and engine as Aikido, with optional AutoFix for supported findings.
Product & Company Updates
AI Pentesting in Action: A TL;DV Recap of Our Live Demo
Aikido AI Pentesting: Live Demo Recap & FAQ
A recap of Aikido’s AI pentesting live demo. See how autonomous agents test real apps, validate findings, generate reports, and enable retesting.
Guides
Top 7 Cloud Security Vulnerabilities
Top 7 Cloud Security Vulnerabilities and How to Prevent Them
Discover the top seven cloud security vulnerabilities affecting modern environments. Learn how attackers exploit IMDS, Kubernetes, misconfigurations, and more, and explore strategies to protect your cloud infrastructure effectively.
Guides & Best Practices
How to Comply With the UK Cybersecurity & Resilience Bill: A Practical Guide for Modern Engineering Teams
Complying With the UK Cybersecurity & Resilience Bill | Security Guide
Learn how to meet the UK Cybersecurity & Resilience Bill requirements, from secure-by-design practices to SBOM transparency, supply chain security, and continuous compliance.
Compliance
React & Next.js DoS Vulnerability (CVE-2025-55184): What You Need to Fix After React2Shell
React & Next.js DoS Vulnerability (CVE-2025-55184) Explained
CVE-2025-55184 is a React Server Components DoS flaw related to React2Shell. Learn who’s affected, how it works, and how to fully patch it.
Vulnerabilities & Threats
Top 9 Kubernetes Security Vulnerabilities and Misconfigurations
Kubernetes Security Vulnerabilities | Top Risks
Learn the most critical Kubernetes security vulnerabilities, common misconfigurations, and why clusters are often exposed by default.
Guides & Best Practices
Top 10 Web Application Security Vulnerabilities Every Team Should Know
Web Application Security Vulnerabilities | Top Risks
Discover the most common web application security vulnerabilities, real-world examples, and how modern teams can reduce risk early.
Guides & Best Practices
OWASP Top 10 for Agentic Applications (2026): What Developers and Security Teams Need to Know
OWASP Top 10 for Agentic Applications (2026): Full Guide to AI Agent Security Risks
Learn the OWASP Top 10 for Agentic Applications. Understand the top AI agent security risks, real-world examples, and how to harden your environment.
Guides & Best Practices
Secrets Detection: A Practical Guide to Finding and Preventing Leaked Credentials
Secret Detection Guide: Find & Prevent Leaks
Learn how secret detection works, what counts as a secret (API keys, tokens, creds), where teams leak them, and how to prevent exposure in git, CI, and production.
Guides & Best Practices
What Is CSPM (and CNAPP)? Cloud Security Posture Management Explained
CSPM vs CNAPP: Cloud Posture Explained
A clear breakdown of CSPM and CNAPP: what they cover, how they reduce cloud risk, key features to look for, and how teams actually adopt them.
Guides & Best Practices
Detecting and Preventing Malware in Modern Software Supply Chains
Preventing Software Supply Chain Malware (Guide)
Explore how supply chain malware lands in modern codebases (typosquatting, dependency confusion, malicious updates) and the defenses that stop it early in CI/CD.
Guides & Best Practices
What Is IaC Security Scanning? Terraform, Kubernetes & Cloud Misconfigurations Explained
IaC Security Scanning for Terraform & Kubernetes
Understand IaC security scanning: how it detects cloud misconfigurations in Terraform/Kubernetes, what to prioritize, and how to prevent risky changes before deploy.
Guides & Best Practices
The Ultimate SAST Guide: What Is Static Application Security Testing?
Ultimate SAST Guide: Static Application Security Testing
A practical SAST explainer: how static application security testing works, what issues it finds, common pitfalls, and how to roll it out without drowning devs in noise.
Guides & Best Practices
Supply Chain Security: The Ultimate Guide to Software Composition Analysis (SCA) Tools
Supply Chain Security Guide: Best SCA Tools
Learn what SCA tools do, what they detect (vulnerable dependencies, licenses, malware), and how to choose the right software composition analysis solution for your stack.
Guides & Best Practices
Critical React & Next.js RCE Vulnerability (CVE-2025-55182): What You Need to Fix Now
Critical React & Next.js RCE Vulnerability CVE-2025-55182 Fix Guide
Learn how CVE-2025-55182 and the related Next.js RCE affect React Server Components. See impact, affected versions, and how to fix. Aikido now detects both issues.
Vulnerabilities & Threats
PromptPwnd: Prompt Injection Vulnerabilities in GitHub Actions Using AI Agents
Prompt Injection Inside GitHub Actions: The New Frontier of Supply Chain Attacks
AI-driven GitHub Actions expose new prompt-injection supply chain vulnerabilities.
Vulnerabilities & Threats
Shai Hulud 2.0: What the Unknown Wonderer Tells Us About the Attackers’ Endgame
Shai Hulud 2.0: What the Unknown Wonderer Reveals About the Attackers’ Endgame
New research into the Shai Hulud 2.0 malware suggests the username UnknownWonderer1 tells us more about the attackers’ endgame.
Vulnerabilities & Threats
SCA Everywhere: Scan and Fix Open-Source Dependencies in Your IDE
SCA in IDE: Scan and Fix Vulnerable Dependencies with AutoFix
Bring the full SCA workflow into your IDE with in-editor scanning and AutoFix. Detect vulnerable packages, review CVEs, and apply safe upgrades without leaving your development workflow.
Product & Company Updates
Safe Chain now enforces a minimum package age before install
SafeChain Now Enforces a Minimum 24-Hour Package Age for Safer Installs
Safe Chain now enforces a minimum 24-hour package age to stop attackers using fresh releases as an entry point. Blocks malware early and falls back to safe versions.
Product & Company Updates
Cloud Security Tools Explained: Key Capabilities & Evaluation Tips
Cloud Security Tools: Features & How to Choose
Discover the essential capabilities of Cloud Security tools and learn how to compare providers to protect your cloud environments.
Guides & Best Practices
ASPM Tools: Essential Features & How to Evaluate Vendors
ASPM Tools: Features & Evaluation Guide
Get an overview of Application Security Posture Management tools, their key capabilities, and the criteria for selecting the right ASPM platform.
Guides & Best Practices
DAST Tools: Features, Capabilities & How to Evaluate Them
DAST Tools: Key Features & Buyer’s Guide
Explore how DAST tools work, their most important features, and the evaluation criteria to consider when choosing a dynamic testing solution.
Guides & Best Practices
SAST Tools: Core Features & How to Choose the Best SAST Solution
SAST Tools: Features & Evaluation Guide
Learn the key capabilities of Static Application Security Testing tools and what to look for when selecting the ideal SAST solution for your workflow.
Guides & Best Practices
Top Javascript Security Tools
Best JavaScript Security Tools for Web & Node.js Apps
Compare top JavaScript security tools to scan npm packages, detect vulnerabilities and secure front-end and Node.js applications.
DevSec Tools & Comparisons
Top Python Security Tools
Top Python Security Tools for Safe Python Development
See the best Python security tools to scan packages, lint code, find vulnerabilities and protect your Python applications from common attacks.
DevSec Tools & Comparisons
Top Github Security Tools For Repository & Code Protection
Best GitHub Security Tools for Secure Repositories
Discover top GitHub security tools for scanning code, secrets and dependencies, protecting repos and enforcing secure development practices.
DevSec Tools & Comparisons
Top SOC 2 Compliance Tools For Automated Audit Readiness
Top SOC 2 Compliance Tools to Simplify Audits
Explore leading SOC 2 compliance tools that streamline evidence collection, map controls and simplify audits for fast-growing teams.
DevSec Tools & Comparisons
Top GCP Security Tools For Safeguarding Google Cloud
Best GCP Security Tools for Google Cloud Protection
Find the best GCP security tools to secure Google Cloud identities, networks, workloads and data with continuous monitoring and alerts.
DevSec Tools & Comparisons
Top Multi Cloud Security Tools
Top Multi-Cloud Security Tools for AWS, Azure & GCP
Discover top multi-cloud security tools that give unified visibility, policy enforcement and threat detection across AWS, Azure and GCP.
DevSec Tools & Comparisons
Top Runtime Security Tools
Best Runtime Security Tools for Cloud-Native Workloads
Learn about the best runtime security tools to detect threats in live containers, Kubernetes clusters and cloud workloads in real time.
DevSec Tools & Comparisons
Top CI/CD Security Tools For Pipeline Integrity
Top CI/CD Security Tools for Secure Software Delivery
Explore top CI/CD security tools that protect build pipelines, sign artifacts and enforce policies across your software delivery process.
DevSec Tools & Comparisons
Top Docker Security Tools
Best Docker Security Tools for Containers & Images
See the leading Docker security tools for scanning images, monitoring containers and enforcing policies in containerized environments.
DevSec Tools & Comparisons
Top Security Monitoring Tools
Top Security Monitoring Tools for Real-Time Threat Detection
Explore top security monitoring tools, including SIEM, log analytics and observability platforms, to detect threats in real time.
DevSec Tools & Comparisons
Top Code Security Tools For Secure Software Development
Top Code Security Tools for Developers in 2025
Discover top code security tools, including SAST, SCA and secret scanning, to secure your repositories and prevent supply chain attacks.
DevSec Tools & Comparisons
Top Software Security Testing Tools
Best Software Security Testing Tools Across the SDLC
Compare the best software security testing tools to scan source code, APIs and applications throughout the SDLC and reduce risk.
DevSec Tools & Comparisons
Top Enterprise Security Tools For Scaling Security Operations
Top Enterprise Security Tools for Large Organizations
Explore top enterprise security tools built for large organizations, covering endpoints, cloud, identities, data and compliance requirements.
DevSec Tools & Comparisons
Top Security Automation Tools
Best Security Automation Tools & SOAR Platforms in 2025
Learn about the top security automation tools and SOAR platforms that orchestrate playbooks, reduce alert fatigue and speed up response.
DevSec Tools & Comparisons
Top IAST Tools For Interactive Application Security Testing
Best IAST Tools for Interactive Application Security Testing
Discover leading IAST tools that analyze running applications, uncover vulnerabilities and improve code security during testing.
DevSec Tools & Comparisons
Top Azure Security Tools
Top Azure Security Tools for Protecting Your Microsoft Cloud
Find the best Azure security tools to secure identities, networks and workloads across Microsoft Azure and hybrid cloud environments.
DevSec Tools & Comparisons
Top 8 AWS Security Tools in 2026
Best AWS Security Tools for Securing Your Cloud Environment
See the best AWS security tools to harden your cloud accounts, detect misconfigurations and monitor workloads across AWS services.
DevSec Tools & Comparisons
NPM Security Audit: The Missing Layer Your Team Still Need
NPM Security Audit: The Missing Layer Your Team Still Need
Learn why npm audit isn’t enough to secure your Node.js dependencies and how Aikido Security provides the deeper, continuous protection your team needs against hidden supply-chain risks.
Guides & Best Practices
Shai Hulud Attacks Persist Through GitHub Actions Vulnerabilities
Shai Hulud Attacks Continue Through GitHub Actions Security Gaps
Shai Hulud threat actors are leveraging GitHub Actions vulnerabilities in an ongoing exploitation campaign. Discover the impact and recommended security measures.
Shai Hulud threat actors are leveraging GitHub Actions vulnerabilities in an ongoing exploitation campaign. Discover the impact and recommended security measures.
Vulnerabilities & Threats
Shai Hulud Launches Second Supply-Chain Attack: Zapier, ENS, AsyncAPI, PostHog, Postman Compromised
Shai Hulud 2.0 Strikes Again: Malware Supply-Chain Attack Hits Zapier & ENS Domains
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
Vulnerabilities & Threats
Revolut Selects Aikido Security to Power Developer-First Software Security
Revolut Chooses Aikido Security to Power Developer-First Software Security
Aikido Security delivers fast, accurate SCA, low-noise vulnerability alerts, and automated dependency upgrades to help Revolut’s global engineering teams maintain strong supply-chain security without slowing development.
Customer Stories
The Future of Pentesting Is Autonomous
The Future of Pentesting Is Autonomous: Announcing Aikido Attack
Meet Aikido Attack: autonomous AI pentesting that detects, exploits, and validates real vulnerabilities across your stack. Fast results, full context, zero noise.
Product & Company Updates
How Aikido and Deloitte are bringing developer-first security to enterprise
How Aikido and Deloitte are bringing developer-first security to enterprise
Discover how Aikido Security and Deloitte Belgium are bringing developer-first, continuous security to the enterprise. Learn how unified tooling, AI-powered testing, and seamless integration deliver real protection at development speed.
News
Top XBOW Alternatives In 2026
Top XBOW Alternatives In 2026
Discover the top XBOW alternatives in 2026. Compare AI pentesting tools like Aikido Security for better coverage, lower false positives, and predictable pricing.
DevSec Tools & Comparisons
Top 7 Black Duck Alternatives in 2026
Top 7 Black Duck Alternatives in 2026
Discover the top 7 Black Duck alternatives for 2026, including Aikido Security, Snyk, Veracode, and more. Compare features, pricing, and why modern DevSecOps teams are leaving Black Duck for faster, developer-first security tools.
DevSec Tools & Comparisons
CORS Security: Beyond Basic Configuration
CORS Security: Beyond Basic Configuration
Learn what CORS really is, how browsers enforce it, and how to configure cross-origin requests securely. A practical guide to avoiding common CORS issues.
A practical guide to avoiding common CORS issues.
Guides & Best Practices
OWASP Top 10 2025: Official List, Changes, and What Developers Need to Know
OWASP Top 10 2025: Key Changes and What Developers Should Know
Discover what’s new in the OWASP Top 10 2025, including software supply chain failures and error handling risks, and how to strengthen your AppSec program.
Guides & Best Practices
Invisible Unicode Malware Strikes OpenVSX, Again
Invisible Unicode Malware Strikes OpenVSX, Again
Another wave of Open VSX extensions were compromised today.
Vulnerabilities & Threats
AI as a Power Tool: How Windsurf and Devin Are Changing Secure Coding
AI as a Power Tool: Secure Coding with Windsurf and Devin
Learn how Windsurf and Devin help developers code faster and stay secure. Real takeaways from Aikido’s Security Masterclass for AI-assisted coding.
Guides & Best Practices
Building Fast, Staying Secure: Supabase’s Approach to Secure-by-Default Development
Security by Design: How Supabase Builds Fast and Stays Secure
Supabase CISO Bill Harmer and Security Engineer Etienne Stalmans share how security is built into every layer of Supabase. From Row Level Security to pgTAP testing, learn how they design systems that move fast and stay secure by default.
Guides & Best Practices
The Top 7 Kubernetes Security Tools
Top 7 Kubernetes Security Tools for 2026
Explore 7 top Kubernetes security tools, open source to AI-powered. Learn how Aikido helps teams secure clusters from code to runtime
DevSec Tools & Comparisons
The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties
GitHub User Compromised with Invisible Malware
Threat actors are using Unprintable Unicode Characters to
Vulnerabilities & Threats
AutoTriage and the Swiss Cheese Model of Security Noise Reduction
AutoTriage and the Swiss Cheese Model of Security Noise Reduction | Aikido Security
Traditional scanners overwhelm teams with false positives. Learn how Aikido’s layered Swiss-cheese approach- combining reachability analysis, reasoning-based AutoTriage, contextual prioritization, and AI-powered AutoFix- reduces security noise, prevents alert fatigue, and accelerates real vulnerability remediation.
Engineering
Security Masterclass: Supabase and Lovable CISOs on Building Fast and Staying Secure
Security Masterclass: Supabase & Lovable CISOs on Building Fast and Staying Secure
Supabase and Lovable CISOs share what every builder needs to keep speed without losing control. Real lessons from the Aikido Security Masterclass.
Guides & Best Practices
Aikido + Secureframe: Keeping compliance data fresh
Aikido + Secureframe Integration: Keep Compliance Fresh
Keep SOC 2 and ISO 27001 compliance accurate with live vulnerability data. Aikido syncs with Secureframe so audits stay fresh and devs keep building.
Compliance
A Guide to Container Privilege Escalation Vulnerabilities
Container Privilege Escalation Vulnerabilities Explained
Learn how container privilege escalation vulnerabilities work, the risks they pose, and steps to prevent attackers from gaining unauthorized access.
Vulnerabilities & Threats
Top 9 Docker Container Security Vulnerabilities
9 Common Docker Container Security Vulnerabilities & Fixes
Discover the top Docker container security vulnerabilities, their risks, and best practices to secure your applications against modern container threats
Vulnerabilities & Threats
Allseek and Haicker are joining Aikido: Building Autonomous AI Pentesting
Allseek and Haicker are joining Aikido: Building Autonomous AI Pentesting
Allseek and Haicker join Aikido to launch Aikido Attack, autonomous pentests that think like hackers and run in hours instead of weeks.
Product & Company Updates
How Aikido Makes Threat Modeling Practical for Developers
Aikido Threat Modeling for DevSecOps | Unified AppSec & Cloud Security
Aikido transforms threat modeling into a developer-first, holistic, automated process with continuous monitoring across code and cloud environments
Learn how Aikido transforms threat modeling into a developer-first, holistic, automated process with continuous monitoring across code and cloud environments
Guides & Best Practices
Secrets Detection… What to look for when choosing a tool
Secrets Detection… What to look for when choosing a tool
Testing secrets detection tools can be difficult, often the worst tools look the best because they capture obvious false positives. This blog explains how secrets detection works and how to run effective tests.
DevSec Tools & Comparisons
Docker & Kubernetes Container Security Explained
Docker & Kubernetes Container Security Explained
Learn how to secure Docker containers and Kubernetes clusters. Best practices, risks, and tools every DevOps team should know.
Guides & Best Practices
Container Scanning & Vulnerability Management
Container Scanning & Vulnerability Management Explained
Discover how container scanning and vulnerability management protect your workloads. Tools, strategies, and automation best practices included.
Guides & Best Practices
Container Security Best Practices in 2026
Container Security Best Practices & Checklist
Follow essential container security best practices and use our checklist to secure Kubernetes, Docker, and containerized applications.
Guides & Best Practices
Container Security - The Dev Guide
Container Security: The Complete Guide
Learn everything about container security — key risks, best practices, and tools to protect Kubernetes, Docker, and cloud-native apps.
Guides & Best Practices
Bugs in Shai-Hulud: Debugging the Desert
Bugs in Shai-Hulud: Debugging the Desert
The Shai Hulud worm had some bugs of its own, and required patching by the attackers. We also look at a timeline of events, to see how it unfolded.
Vulnerabilities & Threats
Cloud Security Assessment: How to Evaluate Your Cloud Posture
Learn how to run a cloud security assessment to evaluate risks, detect misconfigurations, and improve your security posture.
Learn how to run a cloud security assessment to evaluate risks, detect misconfigurations, and improve your security posture.
Guides & Best Practices
Cloud Container Security: Protecting Kubernetes and Beyond
Cloud Container Security: Protecting Kubernetes & Beyond
Find out how to secure containers and Kubernetes environments with the latest tools, practices, and security strategies.
Guides & Best Practices
Cloud-Native Security Platforms: What They Are and Why They Matter
Cloud-Native Security Platforms: What They Are & Why They Matter
Learn what cloud-native security platforms (CNSPs) are, their benefits, and why they’re crucial for modern cloud security.
Guides & Best Practices
Cloud Application Security: Securing SaaS and Custom Cloud Apps
Cloud Application Security: Securing SaaS & Cloud Apps
Discover strategies to secure SaaS platforms and custom cloud applications from evolving threats and vulnerabilities.
Guides & Best Practices
Cloud Security Architecture: Principles, Frameworks, and Best Practices
Cloud Security Architecture: Principles & Best Practices
Learn the core principles, frameworks, and best practices of cloud security architecture to strengthen your cloud defenses.
Guides & Best Practices
The Future of Cloud Security: AI, Automation, and Beyond
The Future of Cloud Security: AI, Automation & Beyond
Explore how AI, automation, and emerging technologies are shaping the future of cloud security in 2025 and beyond.
Guides & Best Practices
Multi-Cloud vs Hybrid Cloud Security: Challenges & Solutions
Multi-Cloud vs Hybrid Cloud Security: Challenges & Solutions
Compare multi-cloud and hybrid cloud security. Learn the unique risks, challenges, and solutions for securing both environments.
Guides & Best Practices
Cloud Security for DevOps: Securing CI/CD and IaC
Cloud Security for DevOps: CI/CD & IaC Security
Secure your DevOps pipelines, CI/CD workflows, and Infrastructure as Code (IaC) with proven cloud security strategies.
Guides & Best Practices
Compliance in the Cloud: Frameworks You Can’t Ignore
Compliance in the Cloud: Key Frameworks You Can’t Ignore
Compliance in the Cloud: Key Frameworks You Can’t Ignore
Guides & Best Practices
Top Cloud Security Threats in 2025
Top Cloud Security Threats in 2025 & How to Prevent Them
Learn the biggest cloud security threats in 2025 and the best prevention strategies to keep your organization secure.
Guides & Best Practices
Cloud Security Best Practices Every Organization Should Follow
Cloud Security Best Practices Every Organization Should Follow
Discover the top cloud security best practices to protect your data, applications, and infrastructure against evolving cyber threats.
Guides & Best Practices
Cloud Security: The Complete Guide
Cloud Security: The Complete 2025 Guide
Explore everything you need to know about cloud security in 2025, from risks and strategies to tools and compliance best practices.
Guides & Best Practices
The Future of API Security: Trends, AI & Automation
The Future of API Security: Trends, AI & Automation in 2025
See how AI, automation, and new trends are shaping the future of API security in 2025 and beyond.
Guides & Best Practices
Web & REST API Security Explained
Web & REST API Security Explained
Understand the fundamentals of web and REST API security — risks, attack vectors, and protection strategies developers must know.
Guides & Best Practices
API Security Testing: Tools, Checklists & Assessments
API Security Testing: Tools, Checklists & Assessments
Learn how to test APIs for vulnerabilities with the right tools, security checklists, and assessment methods.
Guides & Best Practices
Top 10 API Security Best Practices & Standards for 2026
API Security Best Practices & Standards Every Team Should Follow
Explore proven API security best practices and industry standards to protect sensitive data, ensure compliance, and reduce risk.
Guides & Best Practices
Top API Security Tools
Best API Security Tools in 2025
Discover the best API security tools in 2025. Compare features, strengths, and use cases to find the right solution for your organization.
Guides & Best Practices
API Security - The Complete 2025 Guide
API Security: The Complete 2025 Guide
Learn everything about API security in 2025 - key risks, standards, tools, and strategies to secure your APIs against modern threats.
Guides & Best Practices
S1ngularity/nx attackers strike again
S1ngularity/nx attackers strike again
The attackers behind the nx attack have struck again, targeting a large amount of packages, with a first-of-its-kind worm payload.
Vulnerabilities & Threats
Why European Companies Choose Aikido as Their Cybersecurity Partner
Why European Companies Choose Aikido Security | Trusted EU Cybersecurity Partner
European companies trust Aikido Security to secure code, cloud, and runtime with GDPR, NIS2 & Cyber Resilience Act compliance and EU data sovereignty.
Security isn’t just technical anymore. For European companies, it’s about compliance, trust, and who you choose to protect your systems.
Compliance
Complying with the Cyber Resilience Act (CRA) using Aikido Security
Cyber Resilience Act Compliance (CRA) with Aikido Security
Learn how to comply with the EU Cyber Resilience Act (CRA). Aikido Security helps developers and security teams meet CRA requirements with automated scanning, SBOM, and runtime protection
Learn how the CRA applies to your company and how Aikido can help you to comply
Compliance
We Got Lucky: The Supply Chain Disaster That Almost Happened
We Got Lucky: The Supply Chain Disaster That Almost Happened
Eighteen widely used open source packages were compromised, downloaded billions of times and embedded across nearly every cloud environment. The community dodged a bullet. But this close call shows just how fragile our software supply chain really is.
Vulnerabilities & Threats
Top AI Coding Tools
Top AI Coding Tools in 2025
Explore the best AI coding tools in 2025. See how they support developers with code generation, debugging, and project efficiency.
DevSec Tools & Comparisons
Top AI Coding Assistants
Best AI Coding Assistants in 2025
Compare the leading AI coding assistants in 2025. Find out which tools speed up development, improve accuracy, and boost productivity.
DevSec Tools & Comparisons
Top AI Code Generators
Best AI Code Generators in 2025
Discover the top AI code generators in 2025 that help developers write, debug, and optimize code faster across multiple languages.
DevSec Tools & Comparisons
duckdb npm packages compromised
duckdb npm packages compromised
The popular package duckdb was compromised by same attackers that hit debug and chalk
Vulnerabilities & Threats
npm debug and chalk packages compromised
npm debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
Vulnerabilities & Threats
Quantum Incident Response
Quantum Incident Response
Quantum computers will break today’s encryption. Learn why incident response won’t help and how quantum readiness can protect your data before it’s too late.
Guides & Best Practices
Aikido for Students and Educators
Aikido for Students and Educators
Aikido for Education offers students hands-on cybersecurity training with real-world security tools, free for all educators.
Product & Company Updates
Free hands-on security labs for your students
Free hands-on security labs for your students
Aikido for Education offers students hands-on cybersecurity training with real-world security tools, free for all educators.
Product & Company Updates
Without a Dependency Graph Across Code, Containers, and Cloud, You’re Blind to Real Vulnerabilities
Dependency Graphs: See Real Vulnerabilities Across Code, Containers, and Cloud
Stop drowning in CVEs. Without a dependency graph across code, containers, and cloud, you’ll miss real vulnerabilities and chase false positives
Vulnerabilities & Threats
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
June 19, 2023
•
Guides

Preventing fallout from your CI/CD platform being hacked

CI/CD is a prime target for hackers, so take steps that prevent fallout. Aikido Security identifies if your cloud is actively defending your CI/CD.

Tags/

#AWS

#Codeship

#Cloud

#CircleCI

June 12, 2023
•
Guides & Best Practices

How to Close Deals Faster with a Security Assessment Report

Aikido’s security assessment report enables startups to establish trust and credibility with leads and potential customers to close deals faster.

Tags/

#AppSec

#DevSecOps

June 5, 2023
•
Guides

Automate Technical Vulnerability Management [SOC 2]

How to become compliant without imposing a heavy workload on your dev team

Tags/
No items found.
June 1, 2023
•
Guides & Best Practices

Preventing prototype pollution in your repository

The Javascript ecosystem has a problem and it’s called prototype pollution. We recommend a solution called nopp, and we'll show you how to implement this.

Tags/

#AppSec

May 16, 2023
•
Guides

How does a SaaS startup CTO balance development speed and security?

As a CTO of multiple early-stage SaaS startups, I've learned some invaluable lessons on how to navigate the delicate dance between development speed and security.

Tags/
No items found.
April 10, 2023
•
Engineering

How a startup’s cloud got taken over by a simple form that sends emails

This is the story of an attacker who gained access to a startup’s Amazon S3 buckets, environment variables, and various internal API secrets.

Tags/

#AWS

#SSRF

#IMDSv1

#Cloud

#IMDSv2

January 19, 2023
•
Product & Company Updates

Aikido Security raises €2 million pre-seed round to build a developer-first software security platform

Belgian SaaS startup Aikido Security has raised €2 million in pre-seed funding from angel investors who support its mission to simplify software security.

Tags/

#AppSec

#Vulnerabilities

•
Guides & Best Practices

6 Pull Request Best Practices for Developers

Explore pull request best practices to enhance teamwork, improve code quality, and streamline reviews for faster, more reliable development workflows.

Tags/

#Code Quality

#AppSec

Product & Company Updates
See all
See all
May 21, 2025
•
Product & Company Updates

Reducing Cybersecurity Debt with AI Autotriage

We dive into how AI can assist us in a meaningful way to triage vulnerabilities and get rid of our security debt.

May 12, 2025
•
Product & Company Updates

Container Security is Hard — Aikido Container AutoFix to Make it Easy

In this post, we’ll explore why updating base images is harder than it seems, walk through real examples, and show how you can automate safe, intelligent upgrades without breaking your app.

May 2, 2024
•
Product & Company Updates

We just raised our $17 million Series A

We've raised $17M to bring “no BS” security to devs. We’re happy to welcome Henri Tilloy from Singular.vc on board, who is again joined by Notion Capital and Connect Ventures. This round comes just 6 months after we raised $5.3M in seed funding. That’s fast.

Vulnerabilities & Threats
See all
See all
December 17, 2025
•
Vulnerabilities & Threats

The Fork Awakens: Why GitHub’s Invisible Networks Break Package Security

A deep dive into a GitHub security flaw where forked commits let attackers spoof dependencies. Understand the commit SHA issue and why package managers need API-level protection.

December 2, 2025
•
Vulnerabilities & Threats

Shai Hulud 2.0: What the Unknown Wonderer Tells Us About the Attackers’ Endgame

New research into the Shai Hulud 2.0 malware suggests the username UnknownWonderer1 tells us more about the attackers’ endgame.

November 25, 2025
•
Vulnerabilities & Threats

Shai Hulud Attacks Persist Through GitHub Actions Vulnerabilities

Shai Hulud threat actors are leveraging GitHub Actions vulnerabilities in an ongoing exploitation campaign. Discover the impact and recommended security measures.

DevSec Tools & Comparisons
See all
See all
August 19, 2025
•
DevSec Tools & Comparisons

Top 12 Dynamic Application Security Testing (DAST) Tools in 2026

Discover the 12 top best Dynamic Application Security Testing (DAST) tools in 2026. Compare features, pros, cons, and integrations to choose the right DAST solution for your DevSecOps pipeline.

July 18, 2025
•
DevSec Tools & Comparisons

Top 13 Container Scanning Tools in 2026

Discover the best 13 Container Scanning tools in 2026. Compare features, pros, cons, and integrations to choose the right solution for your DevSecOps pipeline.

July 17, 2025
•
DevSec Tools & Comparisons

Top 10 Software Composition Analysis (SCA) tools in 2026

SCA tools are our best line of defense for open-source security, this article explores the top 10 open-source dependency scanners for 2026

Guides & Best Practices
See all
See all
September 2, 2024
•
Guides & Best Practices

SAST vs DAST: What you need to know.

Get an overview of SAST vs DAST, what they are, how to use them together, and why they matter for your application security.

August 10, 2023
•
Guides & Best Practices

Aikido’s 2025 SaaS CTO Security Checklist

Don't be an easy target for hackers! Find out how to secure your SaaS company and keep your code and app 10x more secure. Over 40 vulnerabilities and tips.

July 11, 2023
•
Guides & Best Practices

How to build a secure admin panel for your SaaS app

Avoid common mistakes when building a SaaS admin panel. We outline some pitfalls and potential solutions specifically for SaaS builders!

Get secure now

Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.

Start Scanning
No CC required
Book a demo
No credit card required | Scan results in 32secs.