PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

2025 State of Code Security: Key Trends and Risks

wiz.io | blog | #cloud | #supply-chain | #github | #ci-cd | #secrets-management | #report | #code-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz's 2025 State of Code Security report: 35% of GitHub repos are public, 61% of organizations have cloud secrets exposed in public repos, and self-hosted CI/CD runners raise lateral-movement risk.
Published
Collected

Related coverage

blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
The Overlooked Attack Surface: Securing Code Repositories, Pipelines, and Developer Infrastructure
Why developer infrastructure—repos, CI/CD pipelines, and registries—is an overlooked attack surface, and how Wiz Code/ASPM extends posture management and threat detection across the supply chain.
blog · wiz.io
Security Posture Management for GitHub: spotting and fixing risks in your GitHub organization just got a lot easier
Wiz extends Security Posture Management to GitHub: spot misconfigured orgs, repositories and branches, exposed secrets and identity risks, and see attack paths from code to cloud.
blog · metabase.com
More, Better, Faster: How we automate Metabase releases
How we went from a manual Metabase release checklist to fully automated daily patch releases with GitHub Actions, reused test builds, and a three-click release UI
incident · wiz.io
GitHub Action tj-actions/changed-files supply chain attack: everything you need to know
Everything to know about the tj-actions/changed-files supply chain attack (CVE-2025-30066): how the compromise leaked CI secrets in public repo logs, attribution clues, and mitigation guidance.
tool · github.com
Peach: Single-user, Local-first Personal Media Library and Management System
Offers a privacy-respecting, local-first alternative for media library indexing and playback, combining cloud-drive integration with automated scraping while keeping sensitive viewing data strictly local.
Back