Why software delivery cannot depend on trust alone
Attackers turned the trusted AsyncAPI CI/CD publishing pipeline against its users, and the provenance checks all came back clean.
John P. Mello Jr.
Freelance technology writer. John's work has appeared in the The Boston Globe and Boston Herald, as well as CFO, CIO, CSO, and Inc. magazines. He is a former managing editor of the Boston Business Journal and Boston Phoenix, as well as a staff writer for Government Security News.
Posts from John P. Mello Jr.
Why software delivery cannot depend on trust alone
OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.
AI domain takeover takeaway: Focus on the harness not the model
Research into an Active Directory takeover with a single AI prompt highlights why organizations need to focus on agentic SOCs.
Why AI coding makes zero trust an AppSec requirement
Traditional SBOMs, signing, and provenance all have blind spots, making them no longer capable of assuring software security.
Can Lean improve security for AI-coded software?
AI coding requires the stack be reconstructed with mathematical proofs built in — a task well suited to the Lean language. Here’s the reality.
AI coding agents: A call to action on dependency cooldowns
Delaying software upgrades creates a buffer against poisoned packages, but transitive dependencies continue to be a problem.
Security teams ditch AI-only pen testing
A new report finds weakening trust in AI-only testing — and more willingness to keep humans in the loop. Here's why.
Akrites marshals the open source community to counter AI threats
Industry heavyweights bring new focus to vulnerabilities in the age of AI. Here’s how it might help improve security.
‘Download pumping’ joins the trust-abuse bandwagon
While this repository vector is not new, researchers have uncovered a new twist for exploiting trusted metrics to hide malicious code.