Aikido
Start for Free
No CC required

Welcome to our blog.

Featured
A Guide to Container Privilege Escalation Vulnerabilities
Top 9 Docker Container Security Vulnerabilities
Allseek and Haicker are joining Aikido: Building Autonomous AI Pentesting
How Aikido Makes Threat Modeling Practical for Developers
Secrets Detection… What to look for when choosing a tool
Docker & Kubernetes Container Security Explained
Container Scanning & Vulnerability Management
Container Security Best Practices
Container Security - The Dev Guide
Bugs in Shai-Hulud: Debugging the Desert
The Future of API Security: Trends, AI & Automation
Web & REST API Security Explained
API Security Testing: Tools, Checklists & Assessments
API Security Best Practices & Standards
Top API Security Tools
API Security - The Complete 2025 Guide
S1ngularity/nx attackers strike again
Why European Companies Choose Aikido as Their Cybersecurity Partner
Complying with the Cyber Resilience Act (CRA) using Aikido Security
We Got Lucky: The Supply Chain Disaster That Almost Happened
Top AI Coding Tools
Top AI Coding Assistants
Top AI Code Generators
duckdb npm packages compromised
npm debug and chalk packages compromised
Quantum Incident Response
Aikido for Students and Educators
Free hands-on security labs for your students
Without a Dependency Graph Across Code, Containers, and Cloud, You’re Blind to Real Vulnerabilities
Top Vibe Coding Tools
Popular nx packages compromised on npm
Vulnerability Management Tools 101: Best Platforms for DevSecOps Teams
Top Secret Scanning Tools
Continuous Pentesting in CI/CD
Using Generative AI for Pentesting: What It Can (and Can’t) Do
Manual vs. Automated Pentesting: When Do You Need AI?
Best Pentesting Tools
Best AI Pentesting Tools
Common Code Review Mistakes (and How to Avoid Them)
Continuous Code Quality in CI/CD Pipelines
Using AI for Code Review: What It Can (and Can’t) Do Today
Manual vs. Automated Code Review: When to Use Each
Code Quality: What Is It and Why It Matters
AI Code Review & Automated Code Review: The Complete Guide
Best AI Code Review Tools
WTF is Vibe Coding Security? Risks, Examples, and How to Stay Safe
AutoTriage Integration in IDE
Trag is now part of Aikido: Secure code at AI speed
Using Reasoning Models in AutoTriage
Why Securing Bazel Builds is So Hard (And How to Make It Easier)
Security-Conscious AI Software Development with Windsurf x Aikido
What Is AI Penetration Testing? A Guide to Autonomous Security Testing
How to Improve Code Quality: Tips for Cleaner Code
Code Review Best Practices: Make Good CRs Better
The Top 6 Best AI Tools for Coding in 2025
6 Pull Request Best Practices for Developers
The Best Code Quality Tools for 2025
The Best 6 Code Analysis Tools of 2025
The Top 8 Best Code Review Tools of 2025
Top 7 Graphite.dev alternatives for AI code review
Top 6 CodeRabbit Alternatives for AI Code Review
The Top 6 Best Static Code Analysis Tools of 2025
Introducing Safe Chain: Stopping Malicious npm Packages Before They Wreck Your Project
Veracode vs Checkmarx vs Fortify
Snyk Vs Mend
Sonarqube Vs Semgrep
Snyk Vs Semgrep
Sonarqube Vs Codacy
Snyk Vs Wiz
Checkmarx Vs Black duck
Snyk Vs Black Duck
Sonarqube Vs Github Advanced Security
Snyk Vs Veracode
Snyk vs Checkmarx: A Technical Leader’s Guide to Code Security Tools
Snyk Vs Github Advanced Security
Snyk Vs Trivy
Sonarqube Vs Coverity
SonarQube vs Fortify: The AppSec Showdown (and a Better Alternative)
Sonarqube Vs Veracode
Sonarqube Vs Sonarcloud
Snyk Vs Sonarqube
Sonarqube Vs Checkmarx
Harden Your Containers with Aikido x Root
Securing Legacy Dependencies with Aikido and TuxCare
10 Common Web Application Security Threats
Best Tools to Scan Open Source Dependencies in 2025
Top Virtual Machine Security Tools in 2025
Top Cloud Security Tools for Modern Teams
Top Surface Monitoring Tools in 2025
Top Automated Pentesting Tools Every DevSecOps Team Should Know
Secure Code in Your IDE, Now Free.
Seamless API Security with Postman x Aikido
The 'no nonsense' list of security acronyms
A deeper look into the threat actor behind the react-native-aria attack
Malicious crypto-theft package targets Web3 developers in North Korean operation
Active NPM Attack Escalates: 16 React Native Packages for GlueStack Backdoored Overnight
Zero day attack prevention for NodeJS with Aikido Zen
Introducing Aikido AI Cloud Search
Top Devsecops Tools in 2025
Top Web Application Security Tools
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
September 24, 2025
•
Product & Company Updates

Allseek and Haicker are joining Aikido: Building Autonomous AI Pentesting

Allseek and Haicker join Aikido to launch Aikido Attack, autonomous pentests that think like hackers and run in hours instead of weeks.

#AI

#Pentesting

September 18, 2025
•
Vulnerabilities & Threats

Bugs in Shai-Hulud: Debugging the Desert

The Shai Hulud worm had some bugs of its own, and required patching by the attackers. We also look at a timeline of events, to see how it unfolded.

#Malware

September 16, 2025
•
Vulnerabilities & Threats

S1ngularity/nx attackers strike again

The attackers behind the nx attack have struck again, targeting a large amount of packages, with a first-of-its-kind worm payload.

#Malware

Subscribe to our changelog.
No spam, guaranteed.

Customer Stories

See how teams like yours are using Aikido to simplify security and ship with confidence.

See all

Compliance

Stay ahead of audits with clear, dev-friendly guidance on SOC 2, ISO standards, GDPR, NIS, and more.

See all

Guides & Best Practices

Actionable tips, security workflows, and how-to guides to help you ship safer code faster.

See all

DevSec Tools & Comparisons

Deep dives and side-by-sides of the top tools in the AppSec and DevSecOps landscape.

See all

Vulnerabilities & Threats

Cut through the noise with real-world CVE breakdowns, malware analysis, exploits, and emerging risks.

See all

Product & Company Updates

What’s new at Aikido—from product launches to big security wins.

See all
Threat Modeling
Cyber Resilience Act
Triaging
AutoTriage
Pentesting
Bazel
Code Quality
OWASP
NIS2
Legaltech
fintech
RASP
End of Life
SQL Injections
DAST
cnapp
cspm
aspm
Infrastructure as a Code IaC
Network Security Monitoring
License Scanners
SBOM
Container Scanning
AppSec
Vulnerabilities
Software Supply Chain Security
API
Dependencies
Continuous Security Monitoring
DevSecOps
Vibe Coding
AI
NPM
autofix
Malware
Article
open-source
SCA
intel
SOC 2
usecase
Tools
SAST
Compliance
CircleCI
Codeship
IMDSv2
Cloud
IMDSv1
SSRF
AWS
June 5, 2023
•
Guides

Automate Technical Vulnerability Management [SOC 2]

How to become compliant without imposing a heavy workload on your dev team

Tags/
No items found.
June 1, 2023
•
Guides & Best Practices

Preventing prototype pollution in your repository

The Javascript ecosystem has a problem and it’s called prototype pollution. We recommend a solution called nopp, and we'll show you how to implement this.

Tags/

#AppSec

May 16, 2023
•
Guides

How does a SaaS startup CTO balance development speed and security?

As a CTO of multiple early-stage SaaS startups, I've learned some invaluable lessons on how to navigate the delicate dance between development speed and security.

Tags/
No items found.
April 10, 2023
•
Engineering

How a startup’s cloud got taken over by a simple form that sends emails

This is the story of an attacker who gained access to a startup’s Amazon S3 buckets, environment variables, and various internal API secrets.

Tags/

#AWS

#SSRF

#IMDSv1

#Cloud

#IMDSv2

January 19, 2023
•
Product & Company Updates

Aikido Security raises €2 million pre-seed round to build a developer-first software security platform

Belgian SaaS startup Aikido Security has raised €2 million in pre-seed funding from angel investors who support its mission to simplify software security.

Tags/

#AppSec

#Vulnerabilities

•
Guides & Best Practices

6 Pull Request Best Practices for Developers

Explore pull request best practices to enhance teamwork, improve code quality, and streamline reviews for faster, more reliable development workflows.

Tags/

#Code Quality

#AppSec

Product & Company Updates
See all
See all
May 21, 2025
•
Product & Company Updates

Reducing Cybersecurity Debt with AI Autotriage

We dive into how AI can assist us in a meaningful way to triage vulnerabilities and get rid of our security debt.

May 12, 2025
•
Product & Company Updates

Container Security is Hard — Aikido Container AutoFix to Make it Easy

In this post, we’ll explore why updating base images is harder than it seems, walk through real examples, and show how you can automate safe, intelligent upgrades without breaking your app.

May 2, 2024
•
Product & Company Updates

We just raised our $17 million Series A

We've raised $17M to bring “no BS” security to devs. We’re happy to welcome Henri Tilloy from Singular.vc on board, who is again joined by Notion Capital and Connect Ventures. This round comes just 6 months after we raised $5.3M in seed funding. That’s fast.

Vulnerabilities & Threats
See all
See all
September 18, 2025
•
Vulnerabilities & Threats

Bugs in Shai-Hulud: Debugging the Desert

The Shai Hulud worm had some bugs of its own, and required patching by the attackers. We also look at a timeline of events, to see how it unfolded.

September 16, 2025
•
Vulnerabilities & Threats

S1ngularity/nx attackers strike again

The attackers behind the nx attack have struck again, targeting a large amount of packages, with a first-of-its-kind worm payload.

September 8, 2025
•
Vulnerabilities & Threats

npm debug and chalk packages compromised

The popular packages debug and chalk on npm have been compromised with malicious code

DevSec Tools & Comparisons
See all
See all
May 30, 2025
•
DevSec Tools & Comparisons

Top Container Scanning Tools in 2025

Discover the best Container Scanning tools in 2025. Compare features, pros, cons, and integrations to choose the right solution for your DevSecOps pipeline.

May 9, 2025
•
DevSec Tools & Comparisons

Top SonarQube Alternatives in 2025

Explore top SonarQube alternatives for static code analysis, bug detection, and clean code in 2025.

May 1, 2025
•
DevSec Tools & Comparisons

Top Dynamic Application Security Testing (DAST) Tools in 2025

Discover the best Dynamic Application Security Testing (DAST) tools in 2025. Compare features, pros, cons, and integrations to choose the right DAST solution for your DevSecOps pipeline.

Guides & Best Practices
See all
See all
September 2, 2024
•
Guides & Best Practices

SAST vs DAST: What you need to know.

Get an overview of SAST vs DAST, what they are, how to use them together, and why they matter for your application security.

August 10, 2023
•
Guides & Best Practices

Aikido’s 2025 SaaS CTO Security Checklist

Don't be an easy target for hackers! Find out how to secure your SaaS company and keep your code and app 10x more secure. Over 40 vulnerabilities and tips.

July 11, 2023
•
Guides & Best Practices

How to build a secure admin panel for your SaaS app

Avoid common mistakes when building a SaaS admin panel. We outline some pitfalls and potential solutions specifically for SaaS builders!

Get secure for free

Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.

Start for Free
No CC required
Book a demo
No credit card required | Scan results in 32secs.