May 2025 Summaries

Opengrep, an open-source tool derived from Semgrep, is designed to scan code for vulnerabilities based on predefined rules and has quickly gained traction since its release in March 2025, supported by vendors like Endor Labs. With features such as Windows support and improved Sarif output, Opengrep has focused on optimizing performance, particularly in rule load times, which is crucial for scanning extensive company repositories and processing pull requests efficiently. Recent tests comparing Opengrep 1.2.2 to Semgrep 1.122.0 revealed that Opengrep is, on average, 3.15 times faster, demonstrating significant performance gains, especially in projects with small to medium codebases. These improvements result from enhanced rule loading, which contributes to shorter pipeline runtimes and lower infrastructure costs, making Opengrep a compelling option for integrating security into CI/CD workflows. Although discrepancies and variations in findings were observed between Opengrep and Semgrep, these were typically minor and expected due to heuristic optimizations and non-deterministic behavior in complex rules. As Opengrep continues to evolve with contributions from a growing community, it positions itself as an efficient and developer-friendly tool for application security testing, promising further advancements in performance, platform support, and reporting capabilities.

The UK's Department for Science, Innovation & Technology has introduced the Software Security Code of Practice (SSCoP), a voluntary framework outlining baseline expectations for software vendors to protect against supply-chain intrusions. The SSCoP is structured around four key themes—software composition and SBOM transparency, securing the build and release pipeline, vulnerability management and patch discipline, and lifecycle transparency and customer communication—each with specific recommendations for vendors. The aim is to enhance secure software development by assigning clear responsibilities to a Senior Responsible Owner (SRO). Endor Labs addresses these challenges by offering a platform for comprehensive dependency intelligence and supply chain security, helping organisations understand software composition, secure build pipelines, manage vulnerabilities, and maintain lifecycle transparency without burdening development processes. This approach aligns with the SSCoP's goals of integrating software security with supply chain security, providing organisations with the tools to ensure complete visibility and rapid response to vulnerabilities across all software components.

A critical vulnerability, identified as CVE-2025-47949, has been discovered in samlify, a popular Node.js library used for implementing SAML 2.0 Single Sign-On (SSO), affecting versions prior to 2.10.0. This vulnerability, a Signature Wrapping attack, allows attackers to forge SAML Responses, potentially leading to authentication bypass and user impersonation, including administrative accounts, by exploiting a parsing flaw in the Service Provider's SAML library. It is considered easy to exploit, requiring only a legitimately signed XML document from an Identity Provider. To mitigate this risk, users are urged to immediately upgrade to samlify version 2.10.0 or later. Samlify's widespread use, with over 200,000 weekly npm downloads, amplifies the potential impact of this security flaw, emphasizing the importance of prompt action to secure systems relying on this library.

Endor Labs has developed context-aware security policies aimed at streamlining security automation for developers by reducing unnecessary noise and speeding up remediation processes, allowing developers to concentrate on genuine risks. Their approach includes finding, action, exception, and remediation policies that are designed to mitigate common frustrations developers face with traditional security measures. Furthermore, Endor Labs introduced their MCP Server, which focuses on delivering effective security solutions that align with modern coding practices, including AI-generated code, by helping AI tools automatically address security risks. The whitepaper, available for download, elaborates on these strategies and was last updated on April 29, 2026. Additionally, Endor Labs will be participating in the BlackHat 2026 event in Las Vegas to further discuss their advancements in security automation.

A recent critical Common Vulnerabilities and Exposures (CVE) alert has been issued for WebDriverManager, an open-source library used mainly for browser automation and UI test pipelines, highlighting a vulnerability related to Improper Restriction of XML External Entity (XXE) Reference. Although labeled critical, the actual risk of exploitation is extremely low, with an EPSS score of just 0.06%, and it primarily affects versions 1.0.0 through 6.0.1, which has been resolved in version 6.1.0. The vulnerability is unlikely to affect most production environments since WebDriverManager is typically a test-only dependency. The vulnerability's real-world impact is contingent on whether the vulnerable code is accessible in an organization's environment and if an attacker can control the host it contacts. Organizations are advised to upgrade to version 6.1.0 and ensure their CI traffic is restricted to trusted domains. Endor Labs provides tools and support to help identify and remediate vulnerabilities with minimal impact, emphasizing the importance of understanding context over relying solely on CVSS scores to assess risks effectively.

Endor Labs enhances security management by offering exception and remediation policies that address specific challenges in complex software environments. Exception policies allow teams to manage unique situations by defining when vulnerabilities can be ignored temporarily, offering clear categories, contextual explanations, and consistent application across development stages. A real-world example includes streamlining triage when vulnerabilities appear in multiple scans. Remediation policies focus on safe dependency upgrades through Upgrade Impact Analysis, which evaluates potential disruptions, reachability, transitive risks, and testing coverage to ensure upgrades do not break the code. This approach is illustrated by the automatic creation of Jira tickets when safe upgrades are identified. Additionally, Endor Labs supports over 100 standard policies with extensive customization options using Rego by the Open Policy Agent, allowing organizations to address unique security concerns, such as unsigned commits or AI model risks, with precision. By providing context and actionable solutions, Endor Labs helps reduce friction between security and development teams, enabling developers to focus on meaningful tasks.

Endor Labs shares insights on managing dependency updates in large Bazel monorepos, emphasizing the benefits and challenges of this approach. The monorepo strategy provides a unified build process and visibility across the codebase, while Bazel ensures consistency by managing dependencies centrally. This setup supports safer updates, faster builds, and predictable outcomes, yet introduces complexities like simultaneous service updates and potential large-scale foundational changes. Effective management involves embracing code visibility, preferring single-dependency updates, avoiding batch upgrades, and making incremental testing a core strategy. Additionally, focusing security scans on binary targets optimizes performance. By treating dependency updates as significant changes and leveraging Bazel's capabilities, organizations can maintain control and visibility over their codebase, ensuring smoother updates and reducing risks.

Thoughtfully designed security policies can significantly ease the workflow for developers and security teams by providing precise, tailored controls rather than overwhelming them with irrelevant alerts. Traditional security policies often frustrate developers with a deluge of security tickets and unnecessary build interruptions, which distracts them from their primary focus of building software. Endor Labs addresses these challenges by implementing finding and action policies that streamline security interventions. Finding policies help identify risks beyond vulnerabilities, such as outdated dependencies or risky maintainers, while action policies automate responses only when necessary, reducing unnecessary disruptions. By providing precise and meaningful security interventions, Endor Labs enhances developer productivity and morale, ensuring that security becomes a supportive aspect of the development process rather than a source of constant frustration. This approach is exemplified by significant reductions in security-related Jira tickets and improved developer trust in the process.

A recent discussion regarding the Go package easyjson highlights concerns over its ties to VK, a Russian company, focusing on software provenance rather than any technical vulnerabilities, as no security risks have been identified in easyjson. Despite its association with a sanctioned entity, easyjson remains a widely vetted and used JSON serialization library within the Go ecosystem, included in projects like Kubernetes, which prioritizes security and reliability. The Go programming language offers structural safeguards against supply chain tampering, such as version pinning and reproducible builds, ensuring controlled risk for downstream users even if a maintainer's circumstances change. While organizations with specific geopolitical concerns may choose to avoid such packages, the focus should remain on rational decision-making and understanding the actual use and impact of dependencies. The discussion around easyjson underscores the importance of evaluating software based on functionality rather than origin, drawing attention to the global nature of open source development, and advocating for informed assessments over reactive responses.