Secure by Design
14 articles on Secure by Design.
-
AppSec
The Salesloft/Drift OAuth Breach: When Your SaaS Integrations Become Attack Vectors
The Salesloft/Drift OAuth breach compromised 700+ organizations through weaponized tokens. Six months of silent credential harvesting via SaaS-to-SaaS trust.
-
AppSec
Stop Treating LLM Agents as Trusted Users: Lessons from GitLab CVE-2021-39935
CISA added CVE-2021-39935 to the KEV catalog in February 2026. LLM agents with broad API access inherit every vulnerability in your attack surface.
-
AppSec
Don't Pipe URLs into Shell Scripts: Lessons from CVE-2026-1281
Ivanti EPMM zero-days CVE-2026-1281 and CVE-2026-1340 (CVSS 9.8) expose the danger of piping remote content into shell execution without validation.
-
OWASP
Thoughts on Fortinet's CVE-2026-24858
CVE-2026-24858 in FortiOS: authentication bypass through alternative path. When network security appliances have auth bypass flaws, perimeter trust collapses.