Blog
17 blog available in the DeepSeek directory
Articles, tutorials, and deep dives on this AI platform β from getting-started guides to advanced techniques and real-world use cases.
securityThe Security Bug Every Node.js Developer Ships to Production
Last year I was doing a code review for a startup. Everything looked fine on the surface, clean code,...
L
Lolo
securitySecurely Exposing Internal GCP VMs using Cloudflare Tunnels
Exposing a web service to the public internet typically involves assigning a public IP address to the...
A
Alexander Tyutin
securityThe Bot That Never Was
How a forged github-actions commit planted a credential-stealing worm in five of my repos, why opening one in an AI editor detonates it, and how the same worm hit 73 Microsoft repos that GitHub disabled in 105 seconds while mine stayed live.
I
Ionut-Cristian Florescu
securityAI Agents in CI/CD: Give Them Context, Not Production Authority
AI coding agents are showing up in CI/CD pipelines more often. They can review code, run tests,...
G
Grigor Khachatryan
securityFound a Coordinated GitHub Follow Botnet Hiding in My Followers?
Eight accounts, six years of creation dates, following counts within a range of 25. Here's how following-list overlap analysis exposed a coordinated inauthentic network that cross-follow detection completely missed.
G
GnomeMan4201
securityThreat modeling LLM apps with the CIA triad and OWASP Top 10
every LLM app you ship has three attack surfaces. confidentiality, integrity, availability. the...
T
ToxSec
securityA LinkedIn Recruiter Sent Me Malware Disguised as a "Pre-Interview Code Review"
A recruiter pitched me a remote engineering role and asked me to review their codebase before the technical interview. The repo turned out to be a five-stage trojan that exfiltrates your environment variables and gives the attacker arbitrary code execution. Here's exactly what was in it, and the simple precaution that defeats the whole class.
V
Vladimir Novick
securityThe Vonage Dev Discussion: Making mistakes
Nobody is perfect! Even the most seasoned developers have made mistakes β itβs all just part of the...
L
Liz Acosta
securityYour dependencies are 48% unmaintained β and SCA tools can't see it
I analyzed 16,000 production packages. Half have lifecycle risk your scanner can't see. Here's uzomuzo β the open-source tool I built to find and fix it.
K
kotakanbe
securityPartial Password Authentication
Recently, I switched to another bank, and after setting up the online banking credentials and trying...
M
Muhammad Hassan
securityI Saw Someone Build an AI-Powered Kali Lab at BSides San Diego. Then I Built My Own.
How a conference demo turned into a full bug bounty lab with Claude Desktop, Discord remote access,...
S
spac3gh0st
securityClaude Mythos Is the First AI to Complete a Full Corporate Cyberattack End-to-End
The UK's AI Security Institute confirmed this week that Claude Mythos, an Anthropic model, became the...
S
Sameer Khan
securityA Small Hardening Trick for .env.local: dotenvx + OS Keychain
A defense layer against increasing supply chain attacks that read your .env files
U
Ustun Ozgur
securityTLS Certificates Are About to Expire Way More Often. Here's How I'm Handling It.
If you manage TLS certificates for anything beyond a single server, the next three years are going to...
L
Luke
securityI Built a Claude Code Slash Command for OWASP Top 10:2025, NIST CSF 2.0 and 850+ Security Checks
A /security-audit slash command for Claude Code that runs white-box and gray-box security analysis mapped to OWASP 2025, NIST CSF 2.0, MITRE ATT&CK, PCI DSS 4.0, ISO 27001 and more. One command, one report.
H
Hafiq Iqmal
securityHow I Built a Semgrep-Like Scanner for AI Agent Skills
AI agents are installing tools, running MCP servers, and executing third-party code on your behalf. But who's checking whether that skill file is safe before it runs?
G
Gus
securityYour Secrets Arenβt Safe: How the .git Directory Can Leak Data via AI Tools
Even if you delete a secret, Git never forgets. This article explores how the .git directory, git commands, and malicious AI tools or plugins can expose sensitive data β plus practical defenses you should implement today.
Y
Yohei Seki