[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-204":3},{"item":4,"lessons":16,"controls":62,"related":91},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-204","SP 800-204","SP 800-204: Security Strategies for Microservices-based Application Systems",11,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST publication on security strategies for applications built from microservices, covering authentication, access management, service discovery, secure communication, monitoring and resilience. Later publications in the 800-204 series address service mesh deployments, attribute-based access control, DevSecOps for cloud-native applications and software supply chain security in CI\u002FCD pipelines.\n\n**In practice.** Applying it well means securing communication between services, typically with mutual TLS, enforcing fine-grained authorisation per service, protecting API gateways and building security checks into automated pipelines. Pipelines themselves are treated as critical systems, with protected credentials and verified artefacts. Evidence includes architecture records, pipeline configuration and monitoring of service traffic.\n\n**Common gaps.** Common gaps are unauthenticated internal service traffic, secrets stored in pipeline configuration and inconsistent policy across services.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58],{"slug":19,"title":20,"published_at":21},"re-enabled-malicious-github-actions-expose-15000-repos","Re-Enabled Malicious GitHub Actions Expose 15,000 Repos","2026-09-25T00:20:27.681+00:00",{"slug":23,"title":24,"published_at":25},"ai-coding-agents-are-doubling-the-rate-of-secrets-sprawl","AI Coding Agents Are Doubling the Rate of Secrets Sprawl","2026-09-24T19:22:35.3+00:00",{"slug":27,"title":28,"published_at":29},"malicious-npm-package-exploits-github-actions-workflow-to-steal-cloud-credentials","Malicious npm Package Exploits GitHub Actions Workflow to Steal Cloud Credentials","2026-08-29T00:21:04.176+00:00",{"slug":31,"title":32,"published_at":33},"700-ai-agents-exploit-ssrf-and-exposed-api-tokens-to-breach-hugging-face","700 AI Agents Exploit SSRF and Exposed API Tokens to Breach Hugging Face","2026-08-28T14:21:51.731+00:00",{"slug":35,"title":36,"published_at":37},"malicious-github-issue-exploits-privileged-ai-agent-in-google-adk-repo","Malicious GitHub Issue Exploits Privileged AI Agent in Google ADK Repo","2026-08-04T14:22:07.971+00:00",{"slug":39,"title":40,"published_at":41},"trusted-appsec-scanners-weaponized-as-supply-chain-attack-vectors","Trusted AppSec Scanners Weaponized as Supply Chain Attack Vectors","2026-07-29T18:21:01.503+00:00",{"slug":43,"title":44,"published_at":45},"miasma-campaign-poisons-immobiliarelabs-npm-packages-via-cicd-privilege-escalation","Miasma Campaign Poisons ImmobiliareLabs npm Packages via CI\u002FCD Privilege Escalation","2026-06-26T22:20:39.576+00:00",{"slug":47,"title":48,"published_at":49},"malicious-pull-requests-poison-cicd-pipelines-across-major-open-source-projects","Malicious Pull Requests Poison CI\u002FCD Pipelines Across Major Open-Source Projects","2026-06-23T20:20:58.814+00:00",{"slug":51,"title":52,"published_at":53},"cicd-pipeline-misconfiguration-exposes-major-open-source-repos-to-hijacking","CI\u002FCD Pipeline Misconfiguration Exposes Major Open Source Repos to Hijacking","2026-06-23T18:20:42.477+00:00",{"slug":55,"title":56,"published_at":57},"github-patches-pwn-request-flaw-in-actionscheckout-to-protect-cicd-pipelines","GitHub Patches 'Pwn Request' Flaw in actions\u002Fcheckout to Protect CI\u002FCD Pipelines","2026-06-23T16:21:27.824+00:00",{"slug":59,"title":60,"published_at":61},"github-actions-blocks-risky-pr-checkouts-to-prevent-secret-theft","GitHub Actions Blocks Risky PR Checkouts to Prevent Secret Theft","2026-06-21T20:20:19.823+00:00",[63,68,73,78,82,87],{"slug":64,"name":65,"problem":66,"stories":67},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",8,{"slug":69,"name":70,"problem":71,"stories":72},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",6,{"slug":74,"name":75,"problem":76,"stories":77},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",3,{"slug":79,"name":80,"problem":81,"stories":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":83,"name":84,"problem":85,"stories":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,{"slug":88,"name":89,"problem":90,"stories":86},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[92,98,104,109,113,117,122,126],{"family":93,"item":94,"code":95,"title":96,"together":97},"cis","16","Control 16","Application Software Security",10,{"family":99,"item":100,"code":101,"title":102,"together":103},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",9,{"family":105,"item":106,"code":107,"title":108,"together":67},"nist-800-53","ac-6","AC-6","Least Privilege",{"family":5,"item":110,"code":111,"title":112,"together":72},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",{"family":5,"item":114,"code":115,"title":116,"together":72},"800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":105,"item":118,"code":119,"title":120,"together":121},"sa-12","SA-12","Supply Chain Protection",5,{"family":93,"item":123,"code":124,"title":125,"together":121},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":93,"item":127,"code":128,"title":129,"together":130},"2","Control 2","Inventory and Control of Software Assets",4]