Can a Docker Hub image be malicious, and how can I check or remove it safely?
I pulled an image from Docker Hub and now I'm worried it might contain malware, such as code that could collect credentials or access files it shouldn't. I…
supply chain attacks
How Can I Tell Whether a Docker Image Is Malicious?
I pulled an image from a public container registry and started worrying that it might contain malware, such as code that could collect credentials or access files it…
How do you protect kubeconfigs and use kubectl safely?
How do you manage kubeconfig files securely on your machine? I'm especially interested in setups where someone works on backend or frontend code while also administering clusters. If…
How do you safely manage kubeconfig files and kubectl credentials?
How are you managing kubeconfig files on your workstation, and what precautions do you take when running kubectl or similar tools? For people who work on applications while…
What’s a practical way to reduce JavaScript supply-chain risk?
I'm relatively new to modern JavaScript development and have become concerned about the number of dependencies pulled into even a small Nuxt frontend. I switched from Node to…
How do you actually protect Python projects from malicious dependencies?
PyPI's package filtering and popularity signals don't seem sufficient anymore. A recent supply-chain incident involving a popular machine-learning ecosystem package showed that even widely used community projects can…