March 2025 Summaries

Measuring and improving security outcomes in a DevSecOps program is crucial for organizations to mature their security processes. Organizations need to regularly measure and refine their security processes to achieve their desired security and risk posture. A unified security governance framework, combined with an application security posture management platform, can help organizations proactively manage overall risk. Effective measurement of key security outcomes, such as open issues backlog, issue aging, mean time to resolve, service level agreement, IDE and CLI test rates, and CI/CD pipelines test rates, is essential for fostering a shared security responsibility among development, security, and operations teams. Organizations should analyze data from DevSecOps processes to identify potential weaknesses or bottlenecks and set a strategy for the future, aligning their security process with organizational goals. By implementing continuous security testing, improving existing processes, and eliminating time wasted by developers, organizations can enhance their DevSecOps strategies in the face of new threats and shifting company priorities. A developer-first security platform like Snyk provides clear and actionable insights into AppSec program performance through purpose-built dashboards and customizable data integration options.

Data poisoning is a sophisticated adversarial attack that manipulates the information used in training artificial intelligence (AI) models, potentially hurting model performance, introducing biases, or creating security vulnerabilities. AI models rely on high-quality and integrity data to learn patterns and make predictions, and compromising this data can distort the model's outputs with dangerous consequences. There are two primary ways data poisoning occurs: direct and indirect attacks, where attackers deliberately inject harmful data into training datasets or exploit external data sources by manipulating web content or crowdsourced datasets that feed into AI models. Detecting data poisoning can be challenging, but there are warning signs such as a sudden drop in model accuracy, unexpected biases in outputs, or unusual misclassification rates. To effectively mitigate the risk of data poisoning, organizations should adopt a comprehensive approach that safeguards AI models at multiple levels, including implementing robust data validation, using trusted data sources, applying data sanitization techniques, monitoring model performance continuously, leveraging secure development tools, enforcing access control policies, and adopting differential privacy techniques. Maintaining data provenance tracking and committing to regular model retraining using clean vetted datasets are also crucial in defending against data poisoning attacks.

The Next.js middleware concept is vulnerable to an authorization bypass, allowing external clients to bypass authentication decisions when issuing requests to protected routes. The vulnerability, identified as CVE-2025-29927, affects mainstream Next.js applications running versions 15.x before 15.2.3, 14.x before 14.2.25, and 13.x before 13.5.9. To avoid the critical authorization bypass and other middleware logic circumvention, developers are urged to upgrade and deploy the latest version of Next.js that carries a fix. Cloudflare allows developers to turn on a managed WAF rule as an opt-in workaround, while Vercel and Netlify hosting platforms do not impact applications hosted on their platforms. Fixes or remediation are available through upgrading to fixed versions, applying firewall rules, or deploying to unaffected cloud hosting platforms.

To overcome appsec challenges, financial institutions must balance speed and compliance while addressing unique risks such as cybercrime, compliance mandates, and data privacy concerns. Automation is crucial for streamlining compliance efforts, integrating continuous security testing and monitoring into the DevSecOps pipeline, and using developer-first security tools. AI-driven tools can accelerate threat detection, vulnerability management, and remediation processes but require a balanced approach with human oversight to handle new and high-risk vulnerabilities effectively. Equipping developers with the right security knowledge builds a strong security posture by investing in developer education and collaborating between security and development teams to embed security at every stage of the development process. A successful appsec strategy includes a well-defined risk management strategy, continuous monitoring, building a security-first culture, and clear communication across teams.

Building a culture of secure coding is crucial for protecting software, businesses, customers, and trust. It's not just about implementing tools or checking boxes on a checklist, but empowering developers through hands-on training, real-time feedback, and fostering curiosity and growth. To achieve this, organizations should build security into every process by making developer security champions a thing, automating where it counts, creating a security playbook, and integrating tools like Snyk into the CI/CD pipeline. Motivating teams to make security a priority involves measuring and celebrating success, bringing stories to life, making security accessible, and setting meaningful goals. Regularly tracking progress and adjusting as needed is essential for measuring success and iterating on the initiative. Ultimately, building a secure coding culture requires empowering developers and aligning security objectives with team goals, leading to a transformative outcome that makes software more resilient, launches smoother, and customers trust the brand.

Snyk's Delta Findings feature helps developers reduce vulnerability fatigue by providing early, seamless remediation and customization. It empowers developers to act on security issues as soon as they introduce them in the development cycle, directly where they work - in the IDE. The feature automatically runs and analyzes project manifest files and application logic code whenever changes are saved, performing static code analysis to find vulnerable and insecure code. It displays vulnerabilities in a clear view, along with details on how to address them, reducing cognitive load for developers. The "delta findings" capability shows developers only security issues introduced by their code, providing focus and aligning their focus with what most security teams value most in their processes. This feature helps developers quickly fix vulnerabilities before pushing a feature or fix that might include security vulnerabilities.

The TJ Actions Changed Files GitHub Action compromise involved a serious security exploit that allowed an attacker with write privileges on the repository to cause encrypted secrets to appear in plaintext in the GitHub Action logs. The attack relied on making an external network call to pull down the malicious code, which was made possible by the use of an orphaned Git commit and manipulated release tags. The vulnerability affected about 23,000 GitHub repositories that used this Action as part of their CI and DevOps workflows. To avoid similar attacks in the future, developers are advised to reference commit hashes directly instead of relying on tags, and to consider using additional custom GitHub Actions to flag unexpected network calls.

AI risk management is crucial for organizations to responsibly leverage the potential of Artificial Intelligence (AI) technology. AI offers transformative capabilities in coding assistance, but these benefits come with risks such as security vulnerabilities and compliance challenges that cannot be overlooked. An effective AI risk management framework ensures that organizations can innovate quickly while minimizing threats to their codebases and operations. AI can introduce security risks by introducing "mines" into the codebase, such as insecure code snippets or logic errors that compromise functionality. However, AI also provides opportunities to reduce risk by automating threat detection, analyzing vast amounts of data, and providing predictive insights. Developing a robust AI risk management framework involves adhering to established standards, such as NIST’s AI Risk Management Framework and ISO guidelines. Organizations must address challenges head-on, including compliance complexities, tool selection, scalability, adoption barriers, and balancing the benefits and risks of AI-driven risk management. Successful organizations can balance leveraging AI's benefits and mitigating its risks by adopting tools like Snyk Code and Snyk AppRisk that provide fast, accurate, and scalable solutions for securing AI-driven development.

The text discusses best practices for handling security alerts and incidents in a DevSecOps program. It highlights the importance of remediating security issues early, tracking and fixing potential vulnerabilities, prioritizing security issues based on severity and risk, leveraging actionable advice on transitive dependencies, continuously monitoring applications, defining an incident response plan, and using tools like Snyk to streamline security efforts. The text also emphasizes the need for organizations to have a comprehensive DevSecOps strategy that includes automated scanning and testing throughout the software development lifecycle, as well as continuous monitoring of applications in production. By implementing these best practices, organizations can improve their security posture and reduce the impact of security threats on their operations.

Snyk has partnered with ServiceNow to revolutionize vulnerability management by combining their market-leading developer security platform with ServiceNow's robust Security Operations capabilities. This partnership aims to streamline vulnerability assignment and response processes, enabling organizations to manage application vulnerabilities more effectively. By leveraging ServiceNow's Vulnerability Assignment rules, teams can automate task assignments based on specific criteria, reducing manual effort and improving accuracy. The integration also enhances the Snyk Security for Application Vulnerability Response module with comprehensive security posture views and streamlined remediation workflows, ultimately boosting security and productivity.

Snyk, a developer-first security platform, has been exploring the use of the open-source Golang project Bento to read data from Kafka streams and materialize intelligence. Snyk is proactively contributing dependency fix updates to secure the Bento project, specifically addressing a vulnerability in the golang.org/x/crypto/ssh library that can be exploited for denial of service attacks. This contribution demonstrates Snyk's commitment to securing open-source projects and has been accepted by the Bento maintainers. Additionally, Snyk has launched its Secure Developer Program, which invites open-source project maintainers to connect their projects to Snyk and receive enterprise-grade security features. A new report on the State of Open Source Security is also available, highlighting the biggest challenges in open source security today.

AI code generation is a technique that uses artificial intelligence to write and improve code, leveraging large language models and specialized AI systems. This method has gained popularity among developers, with 92% of developers having already used AI coding tools at work or on personal projects. AI-generated code can speed up development, reduce repetitive tasks, and free developers to focus on innovation. However, it also comes with security risks if the training data includes insecure patterns or vulnerabilities. To mitigate these risks, organizations should implement best practices for secure AI-assisted coding, such as reviewing AI-generated code before integration and using tools like Snyk Code's real-time static application security testing (SAST). AI-powered coding has various benefits, including faster development, reduced costs, and improved code quality. Nevertheless, it also has limitations and challenges, such as a lack of context awareness and the potential for over-reliance on automation.

DevSecOps automation integrates security into every stage of software development, ensuring speed, scalability, and security integration. Automation is crucial to avoid delays in product releases, maintain consistency in security policies, and minimize human errors. Implementing a successful DevSecOps automation strategy requires careful planning, prioritizing security at the earliest stages of development, automating static application security testing, infrastructure as code security tools, and automated policy enforcement. This approach accelerates software delivery, improves productivity, enhances compliance management, and prevents costly breaches, ultimately leading to substantial cost savings. Various tools support DevSecOps automation across different stages of development, including Snyk Code for static application security testing, dynamic application security testing, software composition analysis, container and infrastructure security, and CI/CD pipeline security.

Snyk Learn has introduced a new learning path focused on API security risks, covering the OWASP Top 10, to help developers, security teams, and IT professionals mitigate common vulnerabilities in APIs. The interactive learning path provides a deep understanding of API security threats and how to defend against them, equipping users with knowledge and best practices to secure their APIs effectively. This course is designed for anyone integrating APIs into applications, safeguarding data, or enhancing an organization's security posture, offering hands-on experience with real-world scenarios and actionable strategies. By completing the learning path, users can gain practical knowledge to improve API and web security, and Snyk Learn offers free, high-quality developer security education resources.

Fetch the Flag CTF 2025 was a global hacking competition that took place from February 27 to an unspecified date, uniting thousands of players worldwide to tackle over 30 challenges across web, binary, exploitation, and more. The event aimed to sharpen security skills, expand knowledge, and contribute to a safer digital world while providing fun for participants. The competition's writeups are available on the #ctf-writeups channel in Discord, offering insights into how players solved the challenges. Snyk is prioritizing developer experience with its newest features, enabling a more streamlined process. Fetch the Flag 2025 was a successful event that brought enthusiasm, creativity, and dedication to the hacking community, and it looks forward to the next event.

ChatGPT, a generative AI tool, can speed up development workflows and boost productivity, but its security and quality of generated code aren't guaranteed. While some developers believe AI-generated code is more secure than human-written code, this isn't always the case. In fact, ChatGPT's output is entirely reliant on training data and prompt engineering, making it insecure from the start if vulnerabilities or mistakes exist in the training data. Developers should assume that any AI-generated code is insecure and take steps to remediate vulnerabilities before deployment. The reliability of ChatGPT-generated code depends on the task it performs and the underlying training data, and nearly 80% of developers admit to bypassing security measures as they believe AI-generated code is "secure enough." To ensure secure coding practices, other security safeguards should exist within a developer's workflow, such as comprehensive security tools and measures. Using large language models like ChatGPT raises significant data security concerns, and companies should assume that no data within GenAI is secure. A dedicated security analysis tool like Snyk Code can help mitigate these risks by integrating seamlessly into a developer's workflow and scanning code in real time for vulnerabilities.

Snyk has detected a security issue in the provided Node.js code that uses the insecure JSON web token method `jwt.decode()` from the `jsonwebtoken` library, which can lead to broken authentication. The vulnerable code fails to verify the signature of the JWT token, allowing anyone to tamper with it and still have the application accept it as valid. Snyk's detection highlights the importance of using secure methods like `jwt.verify()` to ensure the integrity of JWT tokens. Additionally, the example Node.js code has other security issues, including hardcoded sensitive data, insufficient logging, rate limiting, token expiration, and improper use of refresh tokens. To secure a REST API with JWT, it is essential to implement strong secret keys, HTTPS transmission, proper token expiration and revocation strategies, and managed refresh tokens.