Welcome to our cheat sheet covering the OWASP Top 10 for LLMs. If you haven’t heard of the OWASP Top 10 before, it’s probably most well known for its web application security edition. The OWASP Top 10 is a widely recognized and influential document published by OWASP focused on improving the security of software and web applications. OWASP has created other top 10 lists (Snyk has some too, as well

Snyk has checked our own systems and tools for usage of OpenSSL v3. We identified that the Snyk Broker, versions 4.127.0 to 4.134.0, uses an affected version of OpenSSL 3.0, and should be upgraded to version 4.135.0 or newer. Snyk Broker enables customers to integrate supported internal SCM platforms with Snyk. On Oct 25, 2022, the OpenSSL project announced a forthcoming release of OpenSSL (versio

This post, originally published on October 18, 2022, has been updated to show how Snyk can help you establish secure JavaScript URL validation. When developers need to handle URLs in different forms for different purposes — such as browser history navigation, anchored targets, query parameters, and so on — we often turn to JavaScript. However, its frequent use motivates attackers to exploit its vu

From reading many Python Docker container blogs, we’ve found that the majority of posts provide examples of how to containerize a Python application independent of its framework (Django, Flask, Falcon, etc.). For example, you might see something like this: 1FROM python 2WORKDIR /usr/app 3COPY . . 4RUN pip install -r requirements.txt 5CMD [ "python", "app.py" ] Two simple steps and it works just fi

September 14, 2022: Check out our new and improved cheat sheet for containerizing Node.js web applications with Docker! Are you looking for best practices on how to build Node.js Docker images for your web applications? Then you’ve come to the right place! The following article provides production-grade guidelines for building optimized and secure Node.js Docker images. You’ll find it helpful rega

On January 8, 2022, the open source maintainer of the wildly popular npm package colors, published colors@1.4.1 and colors@1.4.44-liberty-2 in which they intentionally introduced an offending commit that adds an infinite loop to the source code. The infinite loop is triggered and executed immediately upon initialization of the package’s source code, and would result in a Denial of Service (DoS) to