July 2025 Summaries

AI coding assistants like GitHub Copilot are revolutionizing software development by generating code, completing boilerplate, and speeding up workflows within editors like VS Code. However, the rapid generation of code increases the need for immediate risk detection to prevent security vulnerabilities. The integration of GitHub Copilot with the Endor Labs application security platform allows developers to scan both AI-generated and human-written code in real-time for vulnerabilities, secrets, and risky dependencies directly within the IDE. This integration enhances Copilot's capabilities by providing real-time security analysis, ensuring that complex code suggestions do not introduce undetected flaws. It involves lightweight scanning that alerts developers to issues as they code, with inline feedback and the ability for Copilot to independently fix vulnerabilities using guidance from Endor Labs. By providing real-time guardrails before code review, supporting AI-driven fixes, and integrating security seamlessly into the coding environment, this integration ensures that developers can maintain focus while ensuring code security, greatly benefiting both developers and security teams. The GitHub Copilot and VS Code integration is available in open preview for Endor Labs customers, offering a streamlined approach to secure coding practices.

As AI code editors like Cursor and GitHub Copilot become increasingly integrated into organizations, they offer substantial productivity gains, including a 10-40% increase in code velocity, but also introduce significant security risks due to the generation of insecure code. Studies indicate that 62% of AI-generated code is inherently insecure, leading developers to write code with vulnerabilities such as missing input validation and hard-coded credentials. Traditional security tools and manual reviews struggle to keep pace with these risks, as they miss around 20% of risky changes, resulting in substantial financial risk from potential breaches. Endor Labs addresses these challenges with its AI-native platform that automates secure code reviews, significantly reducing the need for human review and preventing unaddressed security risks. This approach not only cuts manual review time and associated costs by over 90% but also helps prevent nearly $12 million in annual unaddressed risk for teams of 300 developers, enabling organizations to manage the security implications of AI-assisted coding more effectively.

Endor Labs is now accessible on Google Cloud Marketplace, providing an efficient way for organizations to integrate and manage software supply chain security from code creation through deployment. This availability enhances flexibility and simplifies procurement for Google Cloud customers, allowing them to utilize existing budgets and partnerships. Endor Labs addresses the increasing security risks associated with the growing use of open-source packages, container images, and AI-generated code by enabling earlier detection and mitigation of vulnerabilities. The platform offers deep program analysis to identify exploitable vulnerabilities, reduces noise from traditional tools, and provides features such as Upgrade Impact Analysis and Endor Patches to streamline risk management. By supporting unified policy enforcement and offering a flexible REST API, Endor Labs facilitates the scaling of application security programs, ensuring consistent security coverage across different scanning types and integration into existing systems.

Endor Labs has developed an AI Security Code Review tool to address security risks introduced through everyday code changes, such as misconfigurations and overly broad permissions, which are often more prevalent than critical CVEs in fast-paced development environments. The tool employs multi-agent analysis to automatically detect changes in application security posture, including Infrastructure as Code (IaC) misconfigurations in tools like Terraform. For instance, it can identify overly permissive IAM policies that violate the principle of least privilege, posing risks like privilege escalation or data exfiltration. By analyzing pull requests (PRs), Endor Labs' AI agents can flag such risks, providing inline, context-aware reviews that transform PRs into proactive security checkpoints. This approach ensures that insecure configurations are caught before they reach production, enhancing the application security process by shifting the focus from chasing issues to preventing them at the source.

AI code editors like Cursor are revolutionizing the way developers write and interact with code by integrating security measures directly into the coding process. The new Endor Labs Cursor integration offers code, dependency, and secrets scanning within the AI coding workflow, ensuring that security vulnerabilities are identified and addressed as code is written. Built to work seamlessly with AI coding agents, Cursor leverages models from OpenAI, Anthropic, and others to provide real-time security feedback, guiding agents to check their output for vulnerabilities. This integration supports several security measures, including scanning source code for flaws, detecting exposed secrets, and checking open-source software dependencies for vulnerabilities. Results are conveniently displayed in the chat window, and in full agent mode, the large language model (LLM) can automatically fix issues by modifying code or upgrading dependencies. By embedding security directly into the development flow, the integration minimizes context switching and interruptions, allowing developers to produce secure code more efficiently while providing security teams with greater confidence in the safety of rapidly iterated code.

Software Composition Analysis (SCA) is vital for identifying third-party code in C and C++ applications, which are prevalent in critical systems like embedded devices and telecommunications. These environments often face challenges in patching vulnerabilities, making early detection of untrusted code crucial. The guide highlights the difficulties traditional SCA tools encounter with C/C++ due to the lack of standard package managers and inconsistent dependency management, compounded by static and dynamic linking and diverse build systems. Endor Labs offers a new methodology for SCA in C/C++, claiming higher accuracy than competitors. The guide uses OpenCV as a case study for testing Endor Labs' tool, emphasizing the importance of a fixed software version for consistent results. It outlines steps for setting up the test environment, running the analysis, and processing results to compare with existing tools. The ultimate goal is to enhance dependency detection accuracy and security in C/C++ applications, and further resources are available for continued evaluation.

In the blog post on secure code prompt patterns, the focus is on the Recursive Criticism and Improvement (RCI) method, which aims to improve the security of AI-generated code solutions by guiding large language models (LLMs) to identify and rectify design flaws and security vulnerabilities. This technique involves a workflow where the AI initially generates code, critiques it for security issues, and then revises it based on its own feedback, effectively creating a "secure-insecure diff" that highlights improvements. The method leverages the LLMs' strength in reviewing and incrementally improving code, rather than generating secure code from scratch, and has been shown to significantly reduce security weaknesses, particularly in languages like Python and C where common flaws include injection risks and memory issues. This approach is particularly useful for functions interacting with user input, filesystems, or authentication logic and can be adopted without requiring users to have extensive security expertise, offering a simple yet effective way to enhance the security of AI-generated code.

A recent security vulnerability, CVE-2025-54313, has been identified in the widely used eslint-config-prettier package, which has over 30 million weekly downloads. The breach involved a malicious install script that targeted Windows systems, potentially allowing attackers remote-code execution on developer machines or CI hosts. The issue stemmed from a phishing attack on a maintainer's npm token, which led to the publication of compromised package versions without GitHub commits. Despite the high integrity impact, the actual risk is mitigated as the malicious payload is Windows-specific and most CI runners use Linux images. The affected versions have been deprecated, and new, clean versions have been released. The incident highlights the vulnerability of open-source ecosystems to supply chain attacks and emphasizes the need for improved security measures such as MFA enforcement and scoped tokens. Users are advised to avoid installing the compromised versions, audit their environments, and stay informed through official security updates.

The vulnerability management landscape has undergone significant changes, transitioning from outdated methods to more context-rich approaches that consider exploitability, reachability, and organizational factors. This shift is essential because traditional practices, such as prioritizing vulnerabilities based solely on base CVSS scores, have proven inefficient, with less than 5% of CVEs being exploited annually. The FedRAMP Continuous Vulnerability Management Standard, though not finalized, aims to address these issues by emphasizing the importance of prioritizing realistically exploitable vulnerabilities and encouraging automated management for cloud service providers. The new guidelines highlight the need for comprehensive tools that provide context on exploitability and reachability, which allows organizations to focus on the small percentage of vulnerabilities that pose real risks. Though these changes demand innovative approaches and tools like Endor Patches, they promise to streamline vulnerability management by reducing operational disruptions and helping meet strict regulatory timelines.

AI coding editors like Cursor and GitHub Copilot are revolutionizing the software development lifecycle by emphasizing the importance of prompt-writing as a critical design document in secure coding practices. Traditionally, the software development process followed a linear sequence of planning, requirements, design, development, testing, and deployment, but AI-driven environments now integrate these steps into the initial coding prompt. This shift necessitates a structured approach to prompt-writing, akin to architecture reviews or threat modeling, to ensure security requirements such as input validation, authentication, and encryption are explicitly specified to prevent vulnerabilities. A structured prompt template helps developers articulate these requirements effectively, ensuring AI-generated code is secure by design, aligns with business needs, and minimizes the need for subsequent security fixes. As LLM-based tools increasingly assume coding responsibilities, treating the prompt as a design artifact allows for a proactive, 'shift-left' approach to security, enabling developers to produce code that meets policy standards and avoids known weaknesses from the outset.

Endor Outpost is a new deployment option from Endor Labs that allows organizations to utilize the full capabilities of the Endor Labs Application Security Platform while keeping their source code within their network, addressing security and compliance concerns prevalent in regulated industries. It operates by deploying the Endor Scheduler within a customer's Kubernetes cluster, which manages scan jobs through ephemeral Endorctl jobs that perform comprehensive analyses like Software Composition Analysis and static code analysis, all on-premises. The system ensures that only scan metadata, not the source code, is sent to the Endor SaaS platform, maintaining strict data privacy. Endor Outpost is designed for easy deployment and management via Helm charts and offers deep integration with various CI/CD pipelines and cloud-hosted source control platforms, enabling seamless embedding of security checks into developer workflows without compromising speed or efficiency. This solution is particularly beneficial for organizations with stringent security requirements, such as those in the Fintech and Tax Compliance industries, allowing them to maintain control over their code while still benefiting from advanced application security features.

Modern development practices emphasize rapid deployment from commit to production, but this can sometimes conflict with necessary security checks. The integration of Endor Labs and Oligo addresses this challenge by maintaining speed while providing security teams with actionable context. Endor Labs' platform begins by ensuring code security during development through live vulnerability data and static analysis, flagging unsafe patterns before code is committed. At build time, it constructs a comprehensive call-graph and prioritizes fixable risks, significantly reducing noise. During CI, Oligo generates a detailed Software Bill of Materials (SBOM) that Endor Labs uses to merge static and runtime data, allowing engineers to see unified findings. Post-deployment, Oligo's runtime protection records execution paths, instantly blocking exploits and enabling rapid, non-disruptive fixes using Endor Patches. This approach not only accelerates remediation but also maintains a secure and efficient development pipeline, reducing remediation work by up to 80% and closing vulnerabilities significantly faster.

Deserialization vulnerabilities remain a critical security threat across various programming languages and frameworks, notably impacting Java, .NET, Python, and PHP. These vulnerabilities, which gained significant attention following a 2015 presentation by researchers Chris Frohoff and Gabriel Lawrence, allow for remote code execution (RCE) by exploiting libraries such as Apache Commons Collections. High-profile incidents, such as the 2016 ransomware attack on the San Francisco Municipal Transportation Agency, underscore the real-world risks. Despite being part of the OWASP Top 10 list as a significant security concern, remediation can be challenging, as seen with Java libraries like org.springframework:spring-web, which is vulnerable to CVE-2016-1000027. The solution often involves substantial updates, such as upgrading to Spring 6, which requires significant changes to the existing infrastructure. To address these challenges, Endor Labs developed Endor Patches, offering backported security fixes that protect against deserialization attacks without necessitating major application rewrites. These patches block known exploit classes at runtime while maintaining the functionality of existing applications, thus providing a practical security solution for organizations unable to immediately overhaul their systems.

At People.ai, security is an integral aspect of development and innovation, especially in the context of leveraging Artificial Intelligence (AI) technologies. The rapid evolution of generative AI has introduced new risks, prompting the need for strategies to manage internal and external threats associated with AI and language model adoption. Tools like GitHub Copilot are enhancing development but also generating security vulnerabilities, necessitating a re-evaluation of application security approaches and the implementation of guardrails to protect customer data. Additionally, the concept of "shadow AI" presents challenges as employees use AI tools without proper oversight, requiring organizations to establish controls and policies for secure AI integration. People.ai is also exploring how AI can augment Security Operations Centers (SOCs) by managing the overwhelming volume of security signals, thereby enabling analysts to focus on complex tasks. The pursuit of ISO 42001 certification underscores the company's commitment to responsible AI usage, providing a framework for managing AI systems. When selecting vendors, People.ai prioritizes those with flexible architectures, strong customer partnerships, and tools that enhance developer experience without disrupting workflows.

People.ai, a leading AI data platform for go-to-market teams, significantly enhanced its application security and compliance by switching from Snyk to Endor Labs. This transition was driven by the need to address excessive false positives, manual triage, and limited codebase coverage with their previous security platform. Endor Labs offered a more accurate, developer-centric approach by prioritizing reachability-based vulnerabilities, integrating smoothly into development workflows, and supporting modern, flexible architectures. As a result, People.ai achieved a 95.7% reduction in false positives and improved compliance with standards such as Microsoft 365 certification and ISO 42001. The new security platform also facilitated faster mean time to remediation by allowing issues to be addressed earlier in the CI/CD pipeline, boosting developer efficiency, and enhancing customer trust. Endor Labs' context-driven insights helped streamline developer and security team collaboration, positioning People.ai to effectively manage risks associated with generative AI and other emerging technologies.