[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-218":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",338,"US National Institute of Standards and Technology (NIST)","**What it covers.** A set of high-level secure software development practices that can be added to any development life cycle. The practices are grouped into four areas: preparing the organisation, protecting the software, producing well-secured software and responding to vulnerabilities. It is widely referenced for software supplier attestation.\n\n**In practice.** Applying it well means mapping your existing development process to the practices and closing gaps, for example threat modelling, code review, automated testing, protection of build systems and code signing. Teams keep records that show practices are followed, such as pipeline configurations, review records, software bills of materials and a vulnerability response process. Buyers can use the same practices to frame questions to suppliers.\n\n**Common gaps.** Gaps typically include unprotected build environments, no structured way to receive and handle vulnerability reports, and practices that exist on paper but are not enforced in the pipeline.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F218\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},330,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":24,"title":25,"published_at":26},"ai-powered-oss-scanner-fast-tracks-vulnerability-disclosure-for-open-source-maintainers","AI-Powered OSS Scanner Fast-Tracks Vulnerability Disclosure for Open Source Maintainers","2026-10-15T20:21:23.114+00:00",{"slug":28,"title":29,"published_at":30},"ai-chatbots-targeted-by-covert-political-influence-networks","AI Chatbots Targeted by Covert Political Influence Networks","2026-10-15T20:20:35.974+00:00",{"slug":32,"title":33,"published_at":34},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","2026-10-15T16:21:36.544+00:00",{"slug":36,"title":37,"published_at":38},"ai-coding-agents-need-zero-trust-security-boundaries-to-prevent-production-disasters","AI Coding Agents Need Zero-Trust Security Boundaries to Prevent Production Disasters","2026-10-13T22:21:43.666+00:00",{"slug":40,"title":41,"published_at":42},"sap-cloud-sdk-flaw-exposes-oauth2-credentials-due-to-patch-regression","SAP Cloud SDK Flaw Exposes OAuth2 Credentials Due to Patch Regression","2026-10-13T20:22:04.987+00:00",{"slug":44,"title":45,"published_at":46},"docker-hub-flaw-allowed-cross-user-image-manipulation-for-over-two-years","Docker Hub Flaw Allowed Cross-User Image Manipulation for Over Two Years","2026-10-13T20:21:33.66+00:00",{"slug":48,"title":49,"published_at":50},"npm-trusted-publishing-flaw-exposed-1500-packages-to-hijacking","npm Trusted Publishing Flaw Exposed 1,500+ Packages to Hijacking","2026-10-13T18:21:16.112+00:00",{"slug":52,"title":53,"published_at":54},"docker-hub-flaw-enabled-image-tampering-and-user-impersonation","Docker Hub Flaw Enabled Image Tampering and User Impersonation","2026-10-13T16:20:46.354+00:00",{"slug":56,"title":57,"published_at":58},"legitimate-tools-weaponized-teams-phishing-npm-worms-and-device-code-abuse","Legitimate Tools Weaponized: Teams Phishing, npm Worms, and Device-Code Abuse","2026-10-13T16:20:16.436+00:00",{"slug":60,"title":61,"published_at":62},"ai-powered-vulnerability-scanning-comes-to-open-source-projects","AI-Powered Vulnerability Scanning Comes to Open-Source Projects","2026-10-09T16:21:30.632+00:00",{"slug":64,"title":65,"published_at":66},"ghostaction-campaign-hijacks-github-maintainer-accounts-to-steal-cloud-credentials-at-scale","GhostAction Campaign Hijacks GitHub Maintainer Accounts to Steal Cloud Credentials at Scale","2026-10-09T14:21:15.572+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",236,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",104,{"slug":79,"name":80,"problem":81,"stories":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",100,{"slug":84,"name":85,"problem":86,"stories":87},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",91,{"slug":89,"name":90,"problem":91,"stories":92},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",54,{"slug":94,"name":95,"problem":96,"stories":97},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",43,[99,105,110,115,121,127,132,138],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","2","Control 2","Inventory and Control of Software Assets",243,{"family":5,"item":106,"code":107,"title":108,"together":109},"800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",233,{"family":100,"item":111,"code":112,"title":113,"together":114},"16","Control 16","Application Software Security",193,{"family":116,"item":117,"code":118,"title":119,"together":120},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",176,{"family":122,"item":123,"code":124,"title":125,"together":126},"gdpr","32","Article 32","Security of processing",111,{"family":100,"item":128,"code":129,"title":130,"together":131},"7","Control 7","Continuous Vulnerability Management",94,{"family":133,"item":134,"code":135,"title":136,"together":137},"nist-800-53","sa-12","SA-12","Supply Chain Protection",71,{"family":139,"item":140,"code":141,"title":142,"together":143},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",70]