Recent posts tagged debuggix

Software supply chain attacks increased 742% between 2020 and 2025. The trend continues upward in 2026. Every dependency you install is a potential entry point for attackers. Here are five practical ways to protect your application. 1. Pin your de...

We ran four security platforms on the same 100 repositories. Here is the raw data on detection rates, false positive rates, and developer time. The Debuggix team conducted a technical comparison across 100 public GitHub repositories. We ran four...

A case study in alert fatigue: how test files, build artifacts, and intentional patterns generate false positives, and why AI filtering changes the equation. The Debuggix team ran a full security scan on Kubernetes Goat, a deliberately vulnerable...

Hardcoded API keys. Exposed Firebase configs. Missing input validation. Wildcard CORS. Unpinned dependencies. The data from 100 repos is consistent. AI coding tools have changed how software gets built. Developers who could not write a function ...

The Debuggix team ran a security experiment across 100 public GitHub repositories. We used 9 engines running in parallel: Semgrep, Bandit, Gitleaks, TruffleHog, Trivy, ESLint, Hadolint, Checkov, and OSV-Scanner. The goal was to collect raw data on ...

The market for GitHub security scanners has matured. Developers have options. Snyk, Semgrep, GitHub Advanced Security, Trivy, Gitleaks, and a dozen other tools compete for attention. Each tool has strengths. Each has weaknesses. The problem is not t...

Welcome to Verified or Not — the series where I put Debuggix to the test against real, known repositories to prove it actually works. For the first 6 episodes, I'm not scanning random code. I'm targeting repos that the security community already k...