Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Randall Degges
Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)
Written by Here's a genuinely unsettling way to lose control of your laptop in 2026. You clone a normal-looking repo, ask your AI coding assistant to "set it up," and it writes an attacker's SSH key into your ~/.ssh/authorized_keys -- without ever really telling you that's what it did. No memory corruption, no zero-day, nothing clever. Just a file in the repo that wasn't the file it claimed to be. That attack is real, it's this week's news, and I'll walk through it.
The Government Just Banned an AI Model. An Engineer's Perspective.
I've spent the better part of three years wiring AI into how my teams build and ship software. So when the news broke this week that the US government had effectively switched off an AI model, I was legitimately shocked. Not for one country. Not for one company. For everyone on the planet, all at once. Three days. That's how long Anthropic's Fable 5 and Mythos 5 models were available before the government ordered them shut off for everyone. Not restricted. Not export-controlled for a list of countries.
Governing Security in the Age of Infinite Signal – From Discovery to Control
Anthropic just open-sourced vulnerability discovery at scale. Now what? A few weeks ago, Anthropic launched Glasswing, a $100 million initiative to use AI to identify vulnerabilities at scale. Around the same time, they introduced Claude Mythos, a system that can autonomously discover and exploit software flaws.
Securing the Agent Skill Ecosystem: How Snyk and Vercel Are Locking Down the New Software Supply Chain
If you've been paying attention to the AI developer tools space lately, you've probably noticed something big happening: AI agents are no longer just chatbots that help you write code. They're evolving into full-blown autonomous systems that can read your email, deploy your applications, manage your infrastructure, and execute arbitrary shell commands on your machine.
The Future of AI Agent Security Is Guardrails
If you've been paying attention to the AI agent space over the past few months, you've probably noticed a pattern: every week brings a new story about an AI agent doing something it absolutely should not have done: reading private emails, exfiltrating credentials, or executing shell commands that a human would have never approved. The OpenClaw saga alone gave us exposed databases, command injection vulnerabilities, and a $16 million scam token, all in the span of about five days.
The AI Security Platform
Why we built Snyk Studio: AI code assistants are incredible at speed but they’re not hired to be your AppSec engineer. Over the past year we kept seeing the same pattern: great-looking code suggestions that quietly introduced risky dependencies, weak crypto, or unsafe input handling. Teams told us they either slowed down to review every snippet, or accepted the risk and queued it into the backlog. Neither felt great.
Developers: is training taking a back seat?
Let’s face it: software development is moving at warp speed. Between the explosion of AI and the ever-present flood of open source vulnerabilities, you’d think staying sharp with the latest cybersecurity skills would be priority number one for dev teams. Apparently not. New data from Snyk’s 2024 State of Open Source Security Report just dropped, and frankly, it’s raising some serious eyebrows. It shows companies are cutting back on investing in essential security tools and training.
Get off my lawn and fix your vulnerabilities!
Written by: April 1, 2025 0 mins read Today, I'm absolutely thrilled to announce our newest innovation in the security space: our new CLI tool, Greybeard. After years of giving polite, professional security advice, we've realized what developers really need is an ornery virtual security expert who tells it like it is. The Problem with Today's Security Tools Let's face it – standard security scan outputs are about as exciting as watching paint dry.
Open source developer tools have won: That’s a supply chain risk Original
It’s a done deal. In terms of market share, mindshare and innovation, open source developer tools have won the battle for the hearts and tool belts of engineers everywhere. From IDEs to build tools to package managers, open source has become the backbone of modern software development environments. While this is a clear triumph for open source, we must also acknowledge the elephant in the room — the potential for massive supply chain risks.
AI Coding Tools: How to Address Security Issues
By signing up for our newsletter, you agree to our Terms of Use and Privacy Policy
Developer Security Archives
By Randall Degges,Wajahat Raja,Kiran Kamity, Founder & CEO, DeepFactor,Andrew Horrigan Why Kiran Kamity, CEO of DeepFactor, and new member on the DevNetwork Advisory Board, is looking forward to DeveloperWeek 2022 Even in the early stages of designing DeepFactor, our goal was always ...
How to Address Security Issues
In 2022, a surge of AI-based coding assistants revolutionized the software development landscape. Since then, these tools have become ubiquitous, deployed by 92% of organizations, according to a recent report. Even though organizations everywhere are using AI-based coding, there remains a tug-of-war within organizations between the benefits and security fears concerning AI-based software development.
The Future Is Here, and It’s Being Shaped by Purpose-Built AI
While AI continues to dominate popular conversation, historically, experts have focused on two prominent schools of AI: Machine learning (ML) and symbolic AI. ML is effective in ambiguous situations but requires abundant training data and doesn’t operate with much transparency. Symbolic AI, due to the level of human direction, can operate with transparency but does not shine in ambiguous scenarios.
Why JWTs Suck as Session Tokens
JSON Web Tokens (JWTs) are so hot right now. They’re all the rage in web development: Trendy? ✓ Secure? ✓ Scalable? ✓ Compact? ✓ JSON? ✓ With all these amazing things going for JWTs, they seem like an unstoppable hype train headed straight for Stack Overflow fame and fortune! But… today I’m here to talk with you about the downsides of using JWTs. Specifically, why it’s a bad idea to use JWTs as session tokens for most people. What are JWTs?
SnykCon 2021 event lineup| App Developer Magazine
SnykCon 2021 events start October 5th and go until the 7th. The free annual developer conference helps you learn to build applications securely and has sessions galore including special guests Troy Hunt, Keren Elazari, Maud Nalpas, Zybszek “Zb” Tenerowicz, Oliver Crawford, and many more. We're only a few weeks away from SnykCon 2021, Snyk's free annual developer conference that helps you learn how to build applications securely running October 5-7.
Build a Video Chat Service with JavaScript, WebRTC, and Okta — SitePoint
This article was originally published on the Okta Developer Blog. Thank you for supporting the partners who make SitePoint possible. As recently as seven short years ago, building video applications on the web was a massive pain. Remember the days of using Flash and proprietary codecs (which often required licensing)? Yuck. In the last few years, video chat technology has dramatically improved and Flash is no longer required.
I can be Apple, and so can you
The Importance of Code Signing and How it Works on *OS Code signing is a security construct that uses public key infrastructure to digitally sign compiled code or even scripting languages to ensure a trusted origin and to ensure that the deployed code has not been modified. On Windows you can cryptographically sign just about everything from .NET binaries to PowerShell scripts.
Build a Flask App in 30 Minutes
Update 5/11/2016: Trying to build authentication in Flask? Check out our new article: Flask Auth in One Line of Code! Flask is an awesome web framework for Python. It’s minimal, it’s simple, and best of all: easy to learn. Today I’m going to walk you through a tutorial for building your very first Flask web app! Just like the official Flask tutorial, you’ll be building your very own micro blog: Flaskr.
Announcing PassProtect: Proactive Web Security
Most web users are completely disconnected from the incredible advancements that have been made in the web security world over the last handful of years. Most web users aren’t notified when their credentials are leaked in a data breach, and, to make matters worse, most users whose credentials are breached never reset their passwords. Wouldn’t it be great if the websites that users visited every day could automatically notify users when the credentials they’re using are unsafe?
Build a Video Chat Service with JavaScript, WebRTC, and Okta
As recently as seven short years ago, building video applications on the web was a massive pain. Remember the days of using Flash and proprietary codecs (which often required licensing)? Yuck. In the last few years, video chat technology has dramatically improved and Flash is no longer required. Today, the video chat landscape is much simpler thanks to WebRTC: an open source project built and maintained by Google, Mozilla, Opera, and others.
4 Guidelines that will Increase Data Security for Your Customers
User data security has been in the spotlight for years now. It seems like every week, if not every day, brings a report of a new breach or vulnerability discovered. From Target to Equifax JP Morgan Chase, it’s a scary world out there, and for many teams, the path to secure customer identity is vast, complicated, and difficult to navigate. A few quick tips can dramatically improve user data security in most environments.
Stop Using JWTs as Session Tokens
JSON Web Tokens (JWTs) are so hot right now. They’re all the rage in web development because they're trendy, secure, scalable, and compact. With all these amazing things going for JWTs, they seem like an unstoppable hype train headed straight for Stack Overflow fame and fortune! Today I’m here to talk with you about the downsides of using JWTs. Specifically, why it’s a bad idea to use JWTs as session tokens for most people.
Please Stop Using Local Storage
Seriously. Just stop it already. I don't know what it is, exactly, that drives so many developers to store session information in local storage, but whatever the reason: the practice needs to die out. Things are getting completely out of hand. Almost every day I stumble across a new website storing sensitive user information in local storage and it bothers me to know that so many developers are opening themselves up to catastrophic security issues by doing so.
Scaling ipify to 30 Billion Requests and Beyond on Heroku
The following is the story of how Randall Degges created a simple API to solve the common problem of external IP address lookup and how he scaled it from zero to over 10 thousand requests per second (30B/month!) using Node.js and Go on Heroku. Several years ago I created a free web service, ipify. It is a highly scalable IP address lookup service. When you make a GET request against it, it returns your public-facing IP address.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Randall
Contact Randall, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack