Show Notes
Developers are no longer just building software. They’re being targeted directly. In this episode, Tanya Janca explains how supply chain attacks reach developers through everyday tools, packages, and workflows. These attacks don’t feel like attacks at first. They look like normal development work until it’s too late. You’ll learn: • How supply chain attacks reach individual developers • Why developer environments are now high-value targets • Where risk shows up in dail...
More from DevSec Station
Two critical PHP vulnerabilities have been disclosed, and even applications written with secure coding practices may be affected. In this special bulletin of DevSec Station, Tanya Janca (SheHacksPurple) explains PHP2Shell, why vulnerabilities in the underlying PHP runtime can put otherwise secure applications at risk, and what developers and organizations should do to protect their systems. In this episode, we cover: Why secure application code alone cannot protect against vulnerabilities in ...
I asked Claude to build me a little application that would greet me every morning. Nothing complicated. Just say hello, call me a Queen, give me a compliment, and share an inspirational quote. Cute, right? Except Claude didn't just write the code. It built the application, published it, executed it, scheduled it to run on my computer, and connected it to an external API I hadn't vetted. But... I hadn't explicitly asked it to do all those things. And the application was missing some rather...
What happens when your AI assistant does exactly what you expect 59 times... and then does something completely bananas on the 60th? While teaching a secure coding class, I watched nearly 60 students use the same AI assistant, programming language, and prompts. For 59 of them, everything went as expected. But one student's AI-generated Python code included instructions to suppress linting checks, followed by code that leaked secrets to an external file. The AI hadn't escaped a sandbox. It ...
Security problems don't generally happen because developers 'don't care' or lack skill. They happen because no one clearly defined what "secure" meant in the first place. When security expectations are left implicit, developers are forced to guess. And that's where vulnerabilities are born. In this episode of DevSec Station, Tanya Janca explains what security requirements are, why they're one of the most overlooked secure development practices, and how developers can start adding them to proj...
Threat modeling has a reputation for being complicated, full of diagrams, and requiring long meetings. In reality, most developers already do it, they just don't realize it. The difference is that doing it intentionally helps you catch security problems before they become security incidents. In this episode of DevSec Station, Tanya Janca breaks threat modeling down into a simple five-step process that any developer can use while designing a feature. You'll learn how to identify what you're pr...