Ayush Bulbule

In November 2025, the software development world was rocked by a massive, automated attack that spread like wildfire through the JavaScript ecosystem. Named after the giant sandworms of Arrakis from the sci-fi novel Dune, the “Shai-Hulud 2.0” (or “The Second Coming”) worm was huge, destructive, and frighteningly fast. If you heard about major companies like Zapier, Postman, or ENS Domains having issues with their software packages this month, this worm was the culprit. But what actually happened? Why was...

In the cloud era, attackers don’t break in — they log in. The cloud is just someone else’s computer. AWS, GCP, and Azure will secure the building, but they won’t lock your apartment door. If you leave a key in the open (like an API key in GitHub), it’s not a matter of if someone enters — but when. Welcome to Cloud Security. It feels like a maze of acronyms and confusing terms, but it’s actually just a few simple habits applied at scale. This guide is your cheat sheet to clear the confusion so you can sto...

Secrets in Code — Don’t Let Your API Keys Become Attack Vectors Ever pushed .env or API keys to GitHub by mistake? You’re not alone — and attackers are watching. What are Secrets in Code? Secrets = Things you don’t want attacker to see in you code. API keys, access tokens, database passwords, encryption keys. Secrets in Code soruce:GitGaurdain If it grants access or performs a privileged action — it’s a secret. How Secrets Leak (and Why It’s Dangerous) Developers often leak secrets without realizing it. ...