Grype

Password Deleted from Git but Still Present: Major CI/CD Security Mistakes

Developers often leave secrets in configuration files, .env examples, or test scripts that end up in Git history. Removing a file in a new commit does not erase previous versions, and .gitignore offers no protection for already tracked content. Pre-commit hooks with tools like Gitleaks can scan staged changes before they reach the repository. Docker images can retain secrets in layers even after removal commands, requiring BuildKit secret mounts instead. Terraform plans and state files may still expose sensitive values marked only as sensitive. Kubernetes workloads need both non-root containers with dropped capabilities and narrowly scoped RBAC roles. Multiple scanning stages from pre-commit through post-deployment help catch issues before they reach production.

Agent, Scan or Beyond: Modern Methods for Comprehensive Infrastructure Vulnerability Scanning

The eighth installment in the Vulnerability Management for Beginners series explains why traditional scanning approaches no longer cover today's dynamic environments. It details three classic methods—Host Discovery, Pentest, and Audit—alongside agent-based scanning, cloud snapshot techniques, passive traffic analysis, container and SCA tools, and integrations with existing IT systems. The guide stresses that agents from Tenable and Qualys complement but do not replace network scanning, while Orca Security and Wiz pioneered disk snapshot analysis for short-lived cloud instances. It also covers container image scanning with Trivy and Grype before deployment, passive monitoring for OT environments, and the importance of combining multiple data sources to eliminate blind spots. Practical recommendations include scanning frequency by asset type and six post-scan steps for effective remediation.

NEOMSA APIM 4.6.0 Eliminates All Critical and High Vulnerabilities Registered in FSTEC BDU

Neoflex has released NEOMSA APIM 4.6.0 with a primary focus on strengthening the security of the platform's supply chain. The team generated an SBOM in CycloneDX format, scanned components and dependencies using Grype, and cross-referenced findings against the FSTEC BDU database. This process reduced total registered vulnerabilities from 57 to 7, completely removing all 10 Critical and 24 High issues. The platform now meets the formal Security Gate criterion requiring zero Critical or High vulnerabilities from the FSTEC database in the final build. Remaining Medium findings are documented and tracked for future updates. The release provides customers with a verified, transparent component inventory that simplifies compliance and integration reviews.