BestHub
Sign in
Tagged articles

Security Scanning

29 articles · Page 1 of 1
Ops Development & AI Practice
Ops Development & AI Practice
Aug 6, 2026 · Information Security

Breaking Application Security Chaos with OWASP DefectDojo's DevSecOps Closed‑Loop

The article explains how the OWASP DefectDojo platform tackles the tool‑explosion problem in DevSecOps by aggregating results from over 120 scanners, standardizing data, automatically de‑duplicating findings, tracking SLA and risk acceptance, and integrating with issue trackers to create a unified Application Security Posture Management (ASPM) governance loop.

ASPMApplication SecurityDefectDojo
0 likes · 8 min read
Breaking Application Security Chaos with OWASP DefectDojo's DevSecOps Closed‑Loop
IT Xianyu
IT Xianyu
Jul 24, 2026 · Information Security

8 CRUD APIs from GPT‑5.6 Sol Reveal 24 Vulnerabilities—Why No Verification for Password Reset?

The author asked GPT‑5.6 Sol to generate eight Flask CRUD endpoints, ran a security scan that uncovered 24 flaws—including 11 critical issues and a password‑reset function without any verification—then iteratively prompted the model to fix them, highlighting that AI‑written code needs explicit security guidance.

AI code generationFlaskGPT-5.6
0 likes · 8 min read
8 CRUD APIs from GPT‑5.6 Sol Reveal 24 Vulnerabilities—Why No Verification for Password Reset?
Java Companion
Java Companion
Jun 25, 2026 · Operations

Turn Any GitHub Repo into an Interactive Code Map with a Single HTML File

CodeFlow is a zero‑dependency, single‑file open‑source tool that loads a GitHub repository in the browser, builds an interactive dependency graph for over thirty languages, and adds features such as blast‑radius impact analysis, security scanning, health scoring, and export options.

Dependency GraphGitHubSecurity Scanning
0 likes · 12 min read
Turn Any GitHub Repo into an Interactive Code Map with a Single HTML File
Black & White Path
Black & White Path
Jun 18, 2026 · Information Security

ADPulse: Open‑Source Read‑Only AD Security Scanner with 35 Checks

ADPulse is an open‑source, read‑only Active Directory security scanner that runs 35 built‑in checks, provides a 100‑point risk score, supports Pass‑the‑Hash authentication, and generates console, JSON, or self‑contained HTML reports with a single command, making it suitable for quick AD health assessments and penetration‑test reconnaissance.

AD auditActive DirectoryOpen Source
0 likes · 8 min read
ADPulse: Open‑Source Read‑Only AD Security Scanner with 35 Checks
AI Open-Source Efficiency Guide
AI Open-Source Efficiency Guide
Jun 13, 2026 · Frontend Development

Brew Browser: Open‑Source Homebrew GUI with Dual‑Version Architecture, Security Scanning & Snapshots for Mac Developers

Brew Browser is a lightweight native GUI for Homebrew that offers both a cross‑platform Tauri version and a macOS‑only Swift version, providing dashboard overviews, searchable package libraries, trend analytics, snapshot backup, optional vulnerability scanning, keyboard shortcuts, and a privacy‑first design, with detailed installation and architecture guidance.

GUIHomebrewOpen Source
0 likes · 12 min read
Brew Browser: Open‑Source Homebrew GUI with Dual‑Version Architecture, Security Scanning & Snapshots for Mac Developers
Raymond Ops
Raymond Ops
Jun 8, 2026 · Cloud Native

Dockerfile Best Practices: Build Efficient, Lightweight, Secure Images

This guide explains how to write Dockerfiles that dramatically reduce image size, speed up builds, and improve security by leveraging layer caching, multi‑stage builds, BuildKit features, proper base‑image selection, and CI/CD integration, with concrete examples for Node.js, Python, Go, and Java projects.

CI/CDDockerfileSecurity Scanning
0 likes · 36 min read
Dockerfile Best Practices: Build Efficient, Lightweight, Secure Images
Geek Labs
Geek Labs
Apr 13, 2026 · Artificial Intelligence

How a 140K‑Star Open‑Source Agent Harness Makes Claude Code Production‑Ready

The article analyzes the systemic shortcomings of AI coding assistants and presents everything‑claude‑code, an open‑source Agent harness that adds plug‑and‑play Skills, automatic learning Instincts, cross‑session Memory, production‑grade Security scanning, and a research‑first development workflow, comparing it with other tools and detailing deployment and best‑practice guidance.

AI codingClaude CodeOpen Source
0 likes · 12 min read
How a 140K‑Star Open‑Source Agent Harness Makes Claude Code Production‑Ready
Raymond Ops
Raymond Ops
Mar 26, 2026 · Cloud Native

How to Shrink Docker Images by 70% and Harden Them with Trivy

This guide explains how to dramatically shrink Docker image sizes by up to 70% using multi‑stage builds, Alpine or Distroless bases, layer merging, .dockerignore, and BuildKit, while also integrating Trivy security scanning, non‑root users, SUID removal, and CI/CD automation to ensure a lean, secure container deployment.

AlpineCI/CDDocker
0 likes · 29 min read
How to Shrink Docker Images by 70% and Harden Them with Trivy
Black & White Path
Black & White Path
Mar 20, 2026 · Information Security

Detect OpenClaw Security Gaps with the Open‑Source Dejavu Baseline Scanner

The article explains why OpenClaw’s autonomous AI‑agent architecture poses serious security risks—exposed ports, default‑off authentication, vulnerable skill plugins, and known CVEs—and presents a seven‑step manual baseline audit plus the open‑source Dejavu tool that automates these checks.

AI agentsCVEDejavu
0 likes · 16 min read
Detect OpenClaw Security Gaps with the Open‑Source Dejavu Baseline Scanner
Black & White Path
Black & White Path
Feb 16, 2026 · Cloud Computing

Distributed IP Proxy Pool on Tencent SCF to Bypass WAF Limits

The article introduces Cloud ProxyPool, a Go‑based distributed IP proxy pool built on Tencent Cloud Functions (SCF) that bypasses WAF IP restrictions, provides step‑by‑step deployment, client configuration, CA certificate installation, proxy settings, a monitoring dashboard, and outlines supported use cases such as crawler IP rotation, IP testing, HTTPS interception, and integration with tools like Burp Suite.

GoIP ProxySCF
0 likes · 4 min read
Distributed IP Proxy Pool on Tencent SCF to Bypass WAF Limits
Ubiquitous Tech
Ubiquitous Tech
Sep 30, 2025 · Artificial Intelligence

16 Practical Ways to Elevate AI Code Review Quality

The article tells of a developer whose code caused a CPU spike, shows how an AI code review tool caught an unnecessary database query, and then outlines sixteen practical ideas—including multi‑turn dialogue, diff analysis, domain fine‑tuning, CI/CD integration, template feedback, intent inference, automated test generation, security scanning, auto‑fix suggestions, performance analysis, readability scoring, and visual reporting—to improve AI‑assisted code review quality.

AI code reviewCI/CDPrompt Engineering
0 likes · 20 min read
16 Practical Ways to Elevate AI Code Review Quality
Volcano Engine Developer Services
Volcano Engine Developer Services
Sep 23, 2025 · Information Security

How to Secure Model Context Protocol (MCP) in AI Ecosystems: Threats and Solutions

This article examines the security challenges of the Model Context Protocol (MCP) in AI applications, analyzes attack surface expansion across creation, runtime, and update phases, and presents a comprehensive AI‑enhanced scanning architecture with mitigation strategies to protect the entire AI ecosystem.

AI securityCloud NativeMCP
0 likes · 23 min read
How to Secure Model Context Protocol (MCP) in AI Ecosystems: Threats and Solutions
Raymond Ops
Raymond Ops
Jun 12, 2025 · Information Security

Build an Automated Security Code Scanning Platform with SonarQube, Jenkins, and SVN

This guide walks you through setting up a fully automated security code detection platform—covering environment preparation, installing JDK, MySQL, SVN, Maven, Tomcat, SonarQube, and Jenkins, configuring each component, integrating them via Jenkins pipelines, and running sample scans to generate actionable security reports.

AutomationJenkinsSecurity Scanning
0 likes · 20 min read
Build an Automated Security Code Scanning Platform with SonarQube, Jenkins, and SVN
DevOps Cloud Academy
DevOps Cloud Academy
Jul 30, 2024 · Operations

Implementing a DevSecOps CI/CD Pipeline with Jenkins, Kubernetes, ArgoCD, and Security Scanners

This article details a comprehensive DevSecOps pipeline that uses Jenkins for CI/CD, Dependency‑Track and DefectDojo for SBOM management, SonarQube and Trivy for static and container scanning, Docker for image builds, and ArgoCD with Kubernetes for automated deployments, illustrating each stage with full code examples.

ArgoCDCI/CDDevOps
0 likes · 15 min read
Implementing a DevSecOps CI/CD Pipeline with Jenkins, Kubernetes, ArgoCD, and Security Scanners
High Availability Architecture
High Availability Architecture
Jun 14, 2024 · Operations

Evolution and Practice of Vivo CICD Artifact Management in DevOps

This article details the evolution of Vivo's CICD artifact management across four stages, explains its core functions such as multi‑type support, unified storage, promotion, security scanning, aging, and permission control, and outlines future directions toward smarter, more integrated, and secure DevOps operations.

Artifact ManagementCICDContinuous Delivery
0 likes · 16 min read
Evolution and Practice of Vivo CICD Artifact Management in DevOps
vivo Internet Technology
vivo Internet Technology
May 29, 2024 · Operations

vivo CICD Artifact Management: Evolution and Implementation Practices

vivo’s CICD artifact management has evolved from manual builds to a comprehensive Platform Management 2.0 that provides unified storage, multi‑type support, version control, promotion, security scanning, lifecycle policies, and fine‑grained access, dramatically reducing errors and operational costs.

Artifact ManagementArtifact PromotionCICD
0 likes · 15 min read
vivo CICD Artifact Management: Evolution and Implementation Practices
Programmer DD
Programmer DD
Apr 20, 2023 · Artificial Intelligence

Boost Your Coding Efficiency with Amazon CodeWhisperer – Free AI Assistant Overview

Amazon CodeWhisperer, a free real‑time AI coding assistant, integrates with popular IDEs to generate code for routine tasks, unfamiliar APIs, and security‑critical snippets across multiple languages, while also offering reference tracking and built‑in vulnerability scanning.

AI coding assistantAmazon CodeWhispererIDE integration
0 likes · 4 min read
Boost Your Coding Efficiency with Amazon CodeWhisperer – Free AI Assistant Overview
Alibaba Cloud Developer
Alibaba Cloud Developer
Jan 5, 2022 · Cloud Native

How to Parse Container Images in Go with go‑containerregistry

This article explains how to programmatically parse container images using Google's go‑containerregistry library, covering basic concepts such as ImageIndex, Image Manifest, layers, and diffIDs, and demonstrates retrieving image metadata, system packages, and Java application dependencies through code examples and practical Go snippets.

Container ImageDockerOCI
0 likes · 16 min read
How to Parse Container Images in Go with go‑containerregistry
JD Cloud Developers
JD Cloud Developers
Dec 16, 2021 · Information Security

Detect and Mitigate the Log4j2 Remote Code Execution Flaw with JD Cloud Tools

This article explains the critical Log4j2 remote code execution vulnerability, offers JD Cloud's free online scanning service, details rapid defense measures using Web Application Firewall and Starshield, and provides step‑by‑step mitigation and upgrade recommendations to protect Java applications.

Cloud securitySecurity ScanningVulnerability
0 likes · 6 min read
Detect and Mitigate the Log4j2 Remote Code Execution Flaw with JD Cloud Tools
Java Backend Technology
Java Backend Technology
Oct 22, 2020 · Information Security

What Caused the Massive P1 Outage? A Real‑World Security Scanning Bug Uncovered

A sudden P1 incident reset all user passwords, and after a thorough investigation the team discovered that a security‑scanning tool’s weak‑password check repeatedly hit login attempts, triggering a bug that caused the outage, highlighting the critical need for proper incident response and security engineering.

DatabaseOperationsP1 incident
0 likes · 7 min read
What Caused the Massive P1 Outage? A Real‑World Security Scanning Bug Uncovered
Programmer DD
Programmer DD
May 10, 2020 · Cloud Computing

What’s New on GitHub? Explore Discussions, Codespaces, and Security Scans

GitHub’s recent Satellite event unveiled major platform upgrades—including the beta‑stage Discussions forum, the cloud‑based Codespaces development environment, enhanced Code and Secret scanning security tools, and private enterprise instances—offering developers richer collaboration, faster setup, and stronger protection.

DiscussionsGitHubSecurity Scanning
0 likes · 5 min read
What’s New on GitHub? Explore Discussions, Codespaces, and Security Scans
Liangxu Linux
Liangxu Linux
Jan 30, 2020 · Information Security

Top 11 Open-Source Code Quality and Security Tools Every Developer Should Know

An overview of eleven essential open-source and commercial tools—including SonarQube, Kritika, DeepScan, Klocwork, CodeSonar, JArchitect, Bandit, Code Climate, Crucible, Fortify, and Codecov—that help developers analyze code quality, detect security vulnerabilities, and integrate seamlessly into CI/CD pipelines across multiple programming languages.

CI/CDOpen-source toolsSecurity Scanning
0 likes · 8 min read
Top 11 Open-Source Code Quality and Security Tools Every Developer Should Know
Qunar Tech Salon
Qunar Tech Salon
Apr 25, 2018 · Fundamentals

Recap of Qunar QTest Conference 2023: Highlights of Technical Sessions

The Qunar QTest Conference held on April 21 showcased a series of technical talks covering test environment governance, code coverage platforms, dynamic BadSQL scanning, machine‑learning‑based mobile performance testing, and case‑bug management systems, providing attendees with practical insights and future development roadmaps.

AutomationQTestSecurity Scanning
0 likes · 4 min read
Recap of Qunar QTest Conference 2023: Highlights of Technical Sessions