Sebastion
←All topics

developer-tools

5 pieces of writing

security13 min read

CVE-2026-21440 and AI file tools show path traversal is an architectural antipattern

Path traversal bugs in AdonisJS, Gogs, rsync and AI development tools point to the same design failure: modern frameworks still delegate file safety to application code at the worst possible boundary.

security12 min read

AI agents turned poisoned repositories and obfuscated code into supply-chain execution paths

security13 min read

Amazon Q, Claude Code and MCP made repository text a supply-chain attack surface

security13 min read

May 2026 developer-tooling compromises: VS Code extensions, PyPI packages and GitHub Actions turned workstations into supply-chain targets

May 2026 supply-chain compromises showed that poisoned developer tooling now targets the identity and execution layer before code reaches a repository.

Checkmarx KICS, npm Bitwarden CLI and GlassWorm show developer trust is the supply chain target
security14 min read

Checkmarx KICS, npm Bitwarden CLI and GlassWorm show developer trust is the supply chain target