Skip to content

Company

Veracode

Application security company providing automated static, dynamic, and software composition analysis tools to find and fix vulnerabilities in code.

Current stories

buildOne report1 publisher

Lovable-built apps and Moltbook leaked through database rules that were missing or wrong

Matt Palmer's scan found 170 of 1,645 Lovable showcase apps leaking data through inadequate Row Level Security, the same kind of gap Wiz found at Moltbook. Before launch, an AI-built app needs a review that tests the database rules behind its public key.

Publishers:dev.to

Reality

Evidence50
Adoption
Not scored
Hype gap0
Incentives35
Confidence55
securityConfirmed8 publishers

Washington puts offensive cyber on contract, and the liability questions start now

An August 13 memorandum lets vetted US firms run surveillance and disruption operations against criminal networks. The controls are written around US persons, not bystanders.

Perspective Coverage

8 publishers
Builder
Builder 29%
Operator
Operator 52%
Investor
Investor 19%

Reality

Evidence72
Adoption
Not scored
Hype gap+25
Incentives55
Confidence64
productOne report1 publisher

JFrog moves Xray's download blocking into a separately priced Curation seat by November 2026

JFrog is deprecating Xray's Block Download between April and November 2026 and moving enforcement into Curation, a product licensed per seat. Teams who use Xray as their gate have eight months to fund a replacement.

Publishers:devops.com

Reality

Evidence35
Adoption45
Hype gap+35
Incentives85
Confidence40
leadershipOne report1 publisher

Security executives want AI agent limits enforced downstream of the model

Agents show up in logs carrying the credentials of the employees whose authority they inherit. The security executives in a CSO Online account want their scope set by proxies, brokered tokens and downstream authorization before deployment.

Publishers:csoonline.com

Reality

Evidence58
Adoption32
Hype gap+22
Incentives76
Confidence52
productOne report1 publisher

AI writes the Dockerfile, and the pipeline is still checking the app code

Two 2026 studies put AI-generated deployment infrastructure at worse than a coin flip, and the gates most CI pipelines run were built for application source, not config.

Publishers:devops.com

Reality

Evidence58
Adoption52
Hype gap+12
Incentives66
Confidence57
buildOne report1 publisher

AI code has sat at 55% secure for two years. Waiting for a better model is not a plan.

Veracode ran more than 150 models over 80 tasks and found 45% of the output carries a known weakness. The level is bad; the flat two-year trend is the part that changes your plan.

Publishers:dev.to

Reality

Evidence55
Adoption
Not scored
Hype gap+25
Incentives78
Confidence48
buildOne report1 publisher

Your scanner finds it in seconds; the average fix now takes 252 days

GitHub now sells Advanced Security as two SKUs, at $19 and $30 per active committer per month. Neither one routes a finding to an owner or enforces a deadline.

Publishers:dev.to

Reality

Evidence28
Adoption
Not scored
Hype gap+34
Incentives74
Confidence33
investOne report1 publisher

Washington licenses private hacking, and hands the contractor the liability

A memorandum signed on August 12 lets vetted US firms run offensive cyber operations against foreign criminal networks. The unpriced term is who absorbs the downside.

Reality

Evidence45
Adoption15
Hype gap+20
Incentives55
Confidence48