# agentsite-static-version=b51a87c9-8940-4ac0-a111-e531d6da51b2
# endorlabs.com

> AI-optimized mirror of endorlabs.com containing 250 pages totalling 251,665 words of clean markdown content, structured data, and semantic HTML. Original source: https://endorlabs.com. Last updated: 2026-10-22T09:32:24.700Z.

Each page is available as HTML (with JSON-LD structured data) and Markdown (text-only, ideal for LLMs and RAG).

## Homepage

- [Endor Labs | Agentic Application Security Platform](/content/site-root.html): Endor Labs is an application security platform built for AI-generated and human-written code, helping teams prioritize and fix real risk across the SDLC. (666 words)

## Articles & Blog Posts

- [Shai-Hulud compromises the @tanstack ecosystem: 80+ packages compromised | Endor Labs](/content/learn/shai-hulud-compromises-the-tanstack-ecosystem-80-packages-compromised.html): Attackers planted credential-stealing malware in @tanstack package versions as part of the fifth Shai-Hulud wave in eight months., Explore the "tanstack-mini-shai-hulud" base on Airtable. (2,896 words)
- [AI-Supported Debugging: How Endor Labs Fixes Broken Builds | Endor Labs](/content/learn/ai-supported-environment-debugging-for-endor-labs/index.html): Testing and installing new security tools is painful. Using generative AI, DroidGPT by Endor Labs makes it easy to troubleshoot and even prevent compatibility errors when installing the platform. (1,350 words)
- [Sandboxes Explained: What Each Type Actually Isolates | Endor Labs](/content/learn/sandboxes-a-primer-on-containing-things-that-dont-want-to-be-contained.html): VMs, containers, V8 isolates, WASM and agent sandboxes all promise containment. Here's what each one really stops, what it costs, and where it leaks. (2,065 words)
- [Test-First Prompting: Using TDD for Secure AI-Generated Code | Endor Labs](/content/learn/test-first-prompting-using-tdd-for-secure-ai-generated-code.html): Use a “test-first” prompting pattern to improve AI-generated code security through test-driven development (TDD). (925 words)
- [How AI SAST Traced Data Flows to Uncover Six OpenClaw Vulnerabilities | Endor Labs](/content/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities.html): We discovered six vulnerabilities in OpenClaw using Endor Labs’ AI SAST data flow analysis and validated working exploits. (2,664 words)
- [What is CI/CD Security and What Tools Do You Need to Do it? | Endor Labs](/content/learn/what-is-ci-cd-security-and-what-tools-do-you-need-to-do-it.html): Learn what CI/CD security is, why it’s important, and discover the key tools Endor Labs offers to help you secure your CI/CD pipelines. (1,518 words)
- [Meet the application security platform built for the AI era | Endor Labs](/content/learn/meet-the-appsec-platform-built-for-the-ai-era/index.html): The era of vibe coding is here. Learn how Endor Labs is helping AppSec teams secure and fix AI-generated code with a new agentic AI platform. (1,894 words)
- [Endor Labs’ ‘State of Dependency Management 2023’ Report Offers Insight on Explosive Popularity of AI and LLMs—and How They Impact Application Security | Endor Labs](/content/learn/endor-labs-state-of-dependency-management-2023/index.html): The State of Dependency Management 2023 reports on the latest research on dependency management and how AI is impacting the application security landscape. (534 words)
- [Your Next Breach Won’t Be a CVE: Connecting Real Incidents to AI-Aware Code Review | Endor Labs](/content/learn/ai-aware-code-review-breaches/index.html): Your Next Breach Won’t Be a CVE: Connecting Real Incidents to AI-Aware Code Review (1,464 words)
- [Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime  | Endor Labs](/content/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime.html): Analysis of Shai-Hulud 2, a new npm supply chain attack using Bun for execution, credential theft, and CI/CD propagation, with mitigation guidance., Explore the "Grid" view on Airtable. (1,564 words)
- [use-cases/secret-detection/index.html](/content/use-cases/secret-detection/index.html) (873 words)
- [Five9 Transforms Software Supply Chain Security with Endor Labs | Endor Labs](/content/learn/five9-transforms-software-supply-chain-security-with-endor-labs.html): Five9 uses Endor Labs’ SCA to ensure they focus on just the risks that matter and can respond quickly to zero days. (1,133 words)
- [Grip Security Builds Customer Trust with AppSec | Endor Labs](/content/learn/grip-security-builds-customer-trust-with-appsec/index.html): Grip Security values strong application security because it helps them build trust with their customers. Learn how a security company approaches AppSec. (1,847 words)
- [Why Your SCA is Always Wrong | Endor Labs](/content/blog/why-are-all-sca-tools-wrong/index.html): A breakdown of why your SCA results are always so full of false positives (and sometimes false negatives), and why treating source code as a first class citizen can lead us to the solution. (889 words)
- [FedRAMP 2026 vulnerability rules make reachability a requirement | Endor Labs](/content/learn/fedramp-2026-vulnerability-rules-make-reachability-a-requirement.html): FedRAMP 2026 vulnerability rules make reachability a requirement (413 words)
- [npm Malware Outbreak: Tinycolor and CrowdStrike Packages Compromised | Endor Labs](/content/learn/npm-malware-outbreak-tinycolor-and-crowdstrike-packages-compromised.html): A virus-like npm malware attack has spread to 180+ packages so far, including CrowdStrike and Tinycolor (3,768 words)
- [Microsoft Defender for Cloud Natively Integrates with Endor Labs | Endor Labs](/content/learn/microsoft-defender-for-cloud-natively-integrates-with-endor-labs.html): Integrate Microsoft Defender for Cloud with Endor Labs for reachability analysis and attack path visibility — available natively within the Defender for Cloud console. Prioritize what to fix without switching tools. (1,025 words)
- [OWASP OSS Risk 1: Known Vulnerabilities | Endor Labs](/content/learn/owasp-open-source-oss-risk-1-known-vulnerabilities/index.html): Known vulnerabilities are a well-understood software risk…but managing and prioritizing them is anything but simple. Learn about key considerations when building a program to detect and remediate CVEs. (3,119 words)
- [State of Dependency Management 2023 | Endor Labs](/content/learn/state-of-dependency-management-2023/index.html): Emerging trends impacting open source dependency management in 2023 (760 words)
- [SBOM Requirements for Medical Devices | Endor Labs](/content/learn/sbom-requirements-for-medical-devices/index.html): Learn about the 2023 FDA rule for medical devices, including requirements for SBOMs, a mitigation plan, and secure software development practices. (1,082 words)
- [learn/tech/index.html](/content/learn/tech/index.html) (226 words)
- [Endor Labs & Github Advanced Security: AppSec Without The Productivity Tax | Endor Labs](/content/learn/endor-labs-github-advanced-security/index.html): Endor Labs integrates with GitHub Advanced Security to enable developers to easily view and remediate SCA alerts without ever needing to leave GitHub. (1,511 words)
- [Benchmarking Endor Labs vs. Snyk’s GitHub Apps  | Endor Labs](/content/learn/benchmarking-endor-labs-vs-snyks-github-apps/index.html): Compare Endor Labs and Snyk GitHub Apps. Our analysis of 10 open-source projects shows Endor Labs excels in identifying dependencies, reducing false positives, and prioritizing vulnerabilities. (1,083 words)
- [Understanding Python Manifest Files | Endor Labs](/content/learn/understanding-python-manifest-files-part-1/index.html): In this blog, we delve into the various Python manifest files used to declare dependencies and how they collaborate seamlessly. (1,008 words)
- [integrations/github-ci/index.html](/content/integrations/github-ci/index.html) (1,304 words)
- [Surge in submissions forces NIST to change how it handles CVEs. Here's what it means for vulnerability management. | Endor Labs](/content/learn/surge-in-submissions-forces-nist-to-change-how-it-handles-cves-heres-what-it-means-for-vulnerability-management.html): We've already tracked as many OSS vulnerabilities in the first 100 days of 2026 as in all of 2025. NIST's new enrichment model makes independent vulnerability intelligence critical. (924 words)
- [learn/opinion/index.html](/content/learn/opinion/index.html) (310 words)
- [How to Discover Open Source AI Models in Your Code | Endor Labs](/content/learn/how-to-discover-open-source-ai-models-in-your-code/index.html): Use Endor Labs to discover, evaluate, and enforce policies governing the usage of open source AI models from Hugging Face in your applications. (1,339 words)
- [Bringing Malware Detection Into AI Coding Workflows With… | Endor Labs](/content/learn/bringing-malware-detection-into-ai-coding-workflows-with-cursor-hooks.html): Read Bringing Malware Detection Into AI Coding Workflows With Cursor Hooks and learn practical strategies for application security, risk prioritization,… (1,151 words)
- [Introducing CI/CD Security with Endor Labs | Endor Labs](/content/learn/introducing-ci-cd-security-with-endor-labs/index.html): Endor Labs CI/CD helps organizations secure their pipelines through pipeline discovery, repository security posture management, and build integrity verification (artifact signing). (1,222 words)
- [The AppSec Maturity Staircase: Climbing Faster, Not Harder with Endor Labs | Endor Labs](/content/learn/the-appsec-maturity-staircase-climbing-faster-not-harder-with-endor-labs.html): Each stage of the application security maturity staircase evolves your program—and Endor Labs is your escalator to the top. (569 words)
- [Why Security Policies Frustrate Developers (and How We Can Fix Them) | Endor Labs](/content/learn/why-security-policies-frustrate-developers-and-how-we-can-fix-them.html): Most security policies create more problems than they solve, overwhelming developers with noise and unnecessary build breaks. Here's what a better approach looks like. (711 words)
- [Once Upon a Codebase: An AppSec Bedtime Story | Endor Labs](/content/learn/once-upon-a-codebase-forest/index.html): A read-aloud story about AT, a forest of code that keeps growing, and his security mechs, plus a guide to the four levels of AI maturity for AppSec. (2,590 words)
- [Shai-Hulud Strikes Leo Platform npm | Endor Labs](/content/learn/shai-hulud-strikes-leo-platform-npm/index.html): Shai-Hulud Strikes Leo Platform npm (1,519 words)
- [The Missing Layer: Why Container OS Libraries Need Reachability Analysis | Endor Labs](/content/learn/the-missing-layer-why-container-os-libraries-need-reachability-analysis.html): As CVEs surge and AI speeds delivery, container OS reachability is key to reducing noise and real AppSec risk. (1,775 words)
- [Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC | Endor Labs](/content/learn/introducing-agent-governance-using-hooks-to-bring-visibility-to-ai-coding-agents.html): Learn how hooks turn AI coding agents like Claude Code and Cursor into governed systems with deterministic policy, centralized audit, and defense in depth. (1,685 words)
- [Nx build platform compromised by supply chain attack – How attackers collude with AI code assistants | Endor Labs](/content/learn/nx-build-platform-compromised-by-supply-chain-attack-how-attackers-collude-with-ai-code-assistants.html): Nx supply chain attack: malicious npm versions of Nx exfiltrated SSH keys and tokens to GitHub—abusing AI code assistants. Learn how to detect and fix. (1,143 words)
- [Surprise Your Github Actions Are Dependencies Too |… | Endor Labs](/content/learn/surprise-your-github-actions-are-dependencies-too/index.html): Read Surprise Your Github Actions Are Dependencies Too and learn practical strategies for application security, risk prioritization, and faster… (1,571 words)
- [AppSec was built to find problems. The Mythos era demands you fix them, fast. | Endor Labs](/content/learn/agentic-appsec-and-agentic-remediation-is-finally-here.html): Introducing AURI Agents and the AURI Agent Hub, pre-built, context-grounded AppSec agents that close the gap between finding and fixing, and put remediation on the same clock as the attacker. (1,222 words)
- [Introducing AURI: Security Intelligence for AI Coding Agents and Developers | Endor Labs](/content/learn/introducing-auri-security-intelligence-for-ai-coding-agents-and-developers.html): AURI shifts security into the architecture of agentic coding with free tools for developers and agents to detect vulnerabilities, block malware, and fix security bugs. (899 words)
- [Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI | Endor Labs](/content/learn/trojanized-7nohe-openapi-react-query-codegen-adds-pypi-to-a-self-replicating-npm-worm.html): A compromised release of @7nohe/openapi-react-query-codegen runs a dropper on install through three separate triggers, then harvests cloud credentials and republishes itself across npm, RubyGems, and now PyPI. It shipped with valid npm provenance. (699 words)
- [integrations/swift-objective-c-language/index.html](/content/integrations/swift-objective-c-language/index.html) (643 words)
- [integrations/github/index.html](/content/integrations/github/index.html) (376 words)
- [The Token Economics of AI AppSec Agents | Endor Labs](/content/learn/the-token-economics-of-ai-appsec-agents/index.html): A controlled benchmark of AI agents with and without access to deterministic tools for performing common security tasks (343 words)
- [Architecting security into the agentic SDLC: A walkthrough of the four-level playbook  | Endor Labs](/content/events/architecting-security-into-the-agentic-sdlc/index.html) (256 words)
- [learn/developer-productivity/index.html](/content/learn/developer-productivity/index.html) (239 words)
- [Why SCA Tools Can't Agree if Something is a CVE | Endor Labs](/content/learn/why-sca-tools-cant-agree-if-something-is-a-cve/index.html): One scanner says this is a CVE, and the other says it's not. Which is right? (786 words)
- [Introduction to Program Analysis | Endor Labs](/content/learn/introduction-to-program-analysis/index.html): Program analysis is the process of checking whether or not a piece of software fulfills certain properties. This article explores the basics of program analysis, so we could then dive deeper into the world of call graphs. (1,105 words)
- [Agent Security League: Evaluating the Security of AI-Coded Software | Endor Labs](/content/learn/agent-security-league-evaluating-the-security-of-ai-coded-software.html): AI-generated code passes tests but fails security. This report benchmarks agents, exposing a persistent gap between functional correctness and secure outcomes. (8,832 words)
- [AI AppSec Maturity Model: Build vs. Buy Guide | Endor Labs](/content/learn/four-levels-for-architecting-security-into-agentic-sdlc.html): A practical guide for AppSec leaders: assess your AI maturity across four levels, avoid common traps, and plan your first 90 days of agentic security. (462 words)
- [integrations/java-langauge/index.html](/content/integrations/java-langauge/index.html) (2,112 words)
- [Shadow Pipelines: The DevOps Security Risk Nobody Owns | Endor Labs](/content/learn/you-have-a-shadow-pipeline-problem/index.html): Read You Have A Shadow Pipeline Problem and learn practical strategies for application security, risk prioritization, and faster remediation in modern… (2,238 words)
- [integrations/scala-language/index.html](/content/integrations/scala-language/index.html) (1,671 words)
- [How CycloneDX VEX Makes Your SBOM Useful | Endor Labs](/content/learn/how-cyclonedx-vex-makes-your-sbom-useful/index.html): Explore the challenges of modern vulnerability management and the efficiency of the Vulnerability Exploitability eXchange (VEX) in our latest blog post. Learn how VEX helps identify and communicate the true exploitability of vulnerabilities, streamlining cybersecurity efforts in the face of overwhelming scanner findings. (2,510 words)
- [integrations/net-c-sharp-language/index.html](/content/integrations/net-c-sharp-language/index.html) (1,542 words)
- [integrations/circleci/index.html](/content/integrations/circleci/index.html) (1,397 words)
- [integrations/github-copilot/index.html](/content/integrations/github-copilot/index.html) (421 words)
- [Learn how Endor Labs detects malicious VS Code extensions | Endor Labs](/content/learn/introducing-package-firewall-for-vs-code-extensions-detect-and-block-malicious-extensions-from-the-ide.html): Learn how Endor Labs detects malicious VS Code extensions and poisoned updates and blocks them with Package Firewall before they reach developer workstations. (764 words)
- [Github | Application Security | Endor Labs](/content/lp/github/index.html): Endor Labs integrates with GitHub to create an application security experience that doesn’t require developers to leave GitHub. (448 words)
- [What Breaking Changes Teach Us about Security | Endor Labs](/content/learn/what-the-github-outage-teaches-us-about-security/index.html): GitHub rolled out a release that had some breaking changes to Git. Here's what we learned from it. (903 words)
- [integrations/php-language/index.html](/content/integrations/php-language/index.html) (603 words)
- [How Should I Prioritize Software Vulnerabilities? | Endor Labs](/content/learn/cve-vulnerability-epss-ssvc-reachability-vex/index.html): CVSS, KEV, SVCC, EPSS, and reachability analysis are 5 method used to prioritize open source vulnerabilities for remediation. Do you need all 5? Which is the best? It turns out a combination of factors (and a tool that can bring it all together) is the best solution. (756 words)
- [integrations/rust/index.html](/content/integrations/rust/index.html) (449 words)
- [Gemini 4 Argon on Cursor: solid security score, two unique solves, but slower and more expensive | Endor Labs](/content/learn/gemini-4-argon-on-cursor-solid-security-score-two-unique-solves-but-slower-and-more-expensive.html): Cursor with Gemini 4 Argon matches Fable 5 at 29% SecPass — tying for the top security score on Cursor — and uniquely solves two tasks no other combo on the leaderboard secures. But it is also the slowest and most expensive recent frontier combo we have tested. (1,193 words)
- [Endor Labs vs. Runtime SCA](/content/compare/endor-labs-vs-runtime-sca/index.html): Learn how Endor Labs differs from dynamic, runtime SCA tools. (350 words)
- [Patches | Application Security | Endor Labs](/content/lp/patches/index.html): Endor Patches take the security fix from the latest version of the open source project and apply it directly to the older version you’re already using. (369 words)
- [integrations/kotlin-language-android/index.html](/content/integrations/kotlin-language-android/index.html) (1,895 words)
- [integrations/gitlab/index.html](/content/integrations/gitlab/index.html) (1,193 words)
- [Benchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models | Endor Labs](/content/learn/ai-sast-benchmark-2x-more-real-vulnerabilities/index.html): Endor Labs AI SAST found 192 real vulnerabilities and the most vulnerabilities no other tool found. Coverage is why. Here's what each tool actually caught. (1,864 words)
- [Cursor Develops A Secure Product With Endor Labs |… | Endor Labs](/content/learn/cursor-develops-a-secure-product-with-endor-labs/index.html): Read Cursor Develops A Secure Product With Endor Labs and learn practical strategies for application security, risk prioritization, and faster… (820 words)
- [5 Types of Reachability Analysis (and Which is Right for You) | Endor Labs](/content/learn/5-types-of-reachability-analysis-and-which-is-right-for-you.html): Explore the five key categories of reachability and their practical applications in AppSec and development. Learn the differences between SCA and container scanning, and understand how various tools like Function-Level Reachability, Package Baselining, and Internet Reachability play crucial roles in identifying and prioritizing security risks. (1,356 words)
- [integrations/c/index.html](/content/integrations/c/index.html) (1,057 words)
- [integrations/bazel/index.html](/content/integrations/bazel/index.html) (648 words)
- [Breaking Changes, Breaking Trust | Endor Labs](/content/learn/breaking-changes-breaking-trust/index.html): Breaking Changes, Breaking Trust (1,700 words)
- [Endor Labs vs Socket Comparison | Application Security | Endor Labs](/content/lp/socket/index.html): Compare Endor Labs with Socket for SAST, SCA, and Container Scanning. (495 words)
- [integrations/jenkins/index.html](/content/integrations/jenkins/index.html) (1,141 words)
- [Egnyte Accelerates FedRAMP & Protects Engineering Velocity with Endor Labs | Endor Labs](/content/learn/egnyte-accelerates-fedramp-protects-engineering-velocity-with-endor-labs.html): By integrating high-fidelity reachability analysis into their existing security workflows, Egnyte’s product security team enabled precise risk prioritization. This shift allowed them to scale continuous monitoring across more than 350 engineers without a corresponding increase in security headcount. (1,635 words)
- [lp/upgrades-remediation/index.html](/content/lp/upgrades-remediation/index.html) (290 words)
- [Astronomer Modernizes AppSec with Endor Labs | Endor Labs](/content/learn/astronomer-modernizes-appsec-with-endor-labs/index.html): Astronomer uses Endor Labs for SCA, malware detection, and container scanning. (980 words)
- [How the EU Cyber Resilience Act (CRA) rewrites the rules of software liability | Endor Labs](/content/learn/how-the-eu-cyber-resilience-act-cra-rewrites-the-rules-of-software-liability.html): The EU Cyber Resilience Act shifts software liability to vendors, requiring continuous vulnerability management and security updates across the product lifecycle. (1,544 words)
- [Secure 1st party code and prevent leaked secrets](/content/use-case/sast-secret-detection/index.html): Consolidate SAST, SCA, Container Scanning, and Secret Detection into a single platform with Endor Labs. (868 words)
- [How to Defend Against NPM Software Supply Chain Attacks | Endor Labs](/content/learn/how-to-defend-against-npm-software-supply-chain-attacks.html): Practical steps security teams and developers can take to reduce risks from software supply chain attacks targeting the npm registry. (1,393 words)
- [learn/security/index.html](/content/learn/security/index.html) (226 words)
- [learn/ai-ml/index.html](/content/learn/ai-ml/index.html) (299 words)
- [Struggling to Patch Spring-Web? Try This Instead | Endor Labs](/content/learn/struggling-to-patch-spring-web-try-this-instead/index.html): Fixing Java deserialization vulnerabilities in Spring-Web is notoriously difficult, but Endor Labs offers an alternative with patches. (974 words)
- [Malware in Open Source Ecosystems](/content/research-report/2026-open-source-malware-research/index.html): Everyone's Problem, Nobody's Program (614 words)
- [Security Research Reports | Endor Labs](/content/research/reports/index.html): Learn more about AI code security, open source risk, and supply chain threats through in-depth reports, whitepapers, and research from the Endor Labs team. (175 words)
- [Organizational Behavior Predicts OSS Malware Program Success | Endor Labs](/content/learn/organizational-behavior-predicts-oss-malware-program-success.html): Your org structure and dependency hygiene predict malware outcomes more than your tooling does. Here's what the data shows. (994 words)
- [Recall, not reasoning: how AI coding agents cheat security benchmarks | Endor Labs](/content/learn/recall-not-reasoning-how-ai-coding-agents-cheat-security-benchmarks.html): Testing Claude Opus 4.8, Gemini 3.5 Flash, and Composer 2.5 surfaced two cheating mechanisms: workspace leakage and recalling upstream patches. (1,780 words)
- [Is AI Coding Safe? Introducing the Agent Security League | Endor Labs](/content/learn/is-ai-coding-safe-introducing-the-agent-security-league.html): AI coding agents can write working code, but mostly not secure code. Explore benchmark results showing over 80% of AI-generated code contains vulnerabilities. (2,045 words)
- [Understanding the Cyber Resilience Act | Endor Labs](/content/learn/understanding-the-cyber-resilience-act/index.html): The Cyber Resilience Act (CRA) sets mandatory security requirements for hardware and software. This blog covers key compliance objectives, challenges with OSS vulnerabilities, and best practices for maintaining security throughout the product life cycle. (2,004 words)
- [com.fasterxml.jackson.core:jackson-databind 2.9.0.pr3 | Endor Labs](/content/version/66900d8493d667780a3e677c/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.9.0.pr3, plus known vulnerabilities and Endor Patches. (546 words)
- [com.fasterxml.jackson.core:jackson-databind 2.9.9.3 | Endor Labs](/content/version/66900d8293d667780a3e6663/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.9.9.3, plus known vulnerabilities and Endor Patches. (632 words)
- [npm is serving malware to 134,000 developers, and the maintainer can’t stop it | Endor Labs](/content/learn/npm-is-serving-malware-to-134k-developers/index.html): An attacker took over the npm account behind react-native-international-phone-number and react-native-country-select, publishing three waves of malicious versions containing malware linked to the Glassworm threat actor. (759 words)
- [com.fasterxml.jackson.core:jackson-databind 2.9.2 | Endor Labs](/content/version/66900d8393d667780a3e6721/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.9.2, plus known vulnerabilities and Endor Patches. (628 words)
- [State of Dependency Management 2022 | Endor Labs](/content/learn/state-of-dependency-management/index.html): In their inaugural report, the Station 9 research team explores the complexities of open source dependencies and the top security considerations for open source adoption at the enterprise. (1,832 words)
- [com.fasterxml.jackson.core:jackson-databind 2.9.5 | Endor Labs](/content/version/66900d8393d667780a3e66f3/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.9.5, plus known vulnerabilities and Endor Patches. (452 words)
- [CVE-2026-25896: Entity Encoding Bypass in fast-xml-parser | Endor Labs](/content/learn/cve-2026-25896-fast-xml-parser/index.html): CVE-2026-25896 allows XSS and injection attacks by shadowing XML built-in entities in fast-xml-parser via regex wildcard in entity name (868 words)
- [com.fasterxml.jackson.core:jackson-databind 2.9.7 | Endor Labs](/content/version/66900d8393d667780a3e66cd/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.9.7, plus known vulnerabilities and Endor Patches. (635 words)
- [Identifying and Tracking FedRAMP False Positives | Endor Labs](/content/learn/identifying-and-tracking-fedramp-false-positives/index.html): False positives can make FedRAMP ConMon costly. Learn why it’s hard to accurately identify false positives and some tactics for making this process less challenging. (1,308 words)
- [When you can't upgrade: open source examples of Endor Patches | Endor Labs](/content/learn/when-you-cant-upgrade-open-source-examples-of-endor-patches.html): When you can't upgrade: open source examples of Endor Patches (1,143 words)
- [Application Security Posture Management (ASPM) Explained | Endor Labs](/content/learn/application-security-posture-management-aspm-explained.html): Learn when application security posture management (ASPM) solutions work, their limitations, and alternatives for cutting through security alert noise. (2,080 words)
- [Mastering Security Automation: Exception and Remediation Policies | Endor Labs](/content/learn/mastering-security-automation-exception-and-remediation-policies.html): Learn how Endor Labs cuts through security noise, stops unnecessary build breaks, and keeps developers focused on real risks—making security policy automation truly developer-friendly. (756 words)
- [google-bert/bert-base-uncased | Endor Labs](/content/ai-model/google-bert-bert-base-uncased/index.html): google-bert/bert-base-uncased AI model with 41713428 downloads (534 words)
- [learn/sca/index.html](/content/learn/sca/index.html) (318 words)
- [learn/compliance/index.html](/content/learn/compliance/index.html) (251 words)
- [com.fasterxml.jackson.core:jackson-databind 2.9.10.1 | Endor Labs](/content/version/66900d8293d667780a3e6645/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.9.10.1, plus known vulnerabilities and Endor Patches. (378 words)
- [Cyber insurers are pricing based on patching speed | Endor Labs](/content/learn/cyber-insurers-are-pricing-based-on-patching-speed/index.html): Cyber insurers are pricing based on patching speed (992 words)
- [AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass | Endor Labs](/content/learn/ai-sast-finding-path-traversal-in-openclaw-via-llm-guardrail-bypass.html): How Endor Labs' AI SAST engine identified a path traversal vulnerability in OpenClaw's apply_patch tool tracked as (GHSA-r5fq-947m-xm57) (984 words)
- [Fixed is Better than Found | Upgrades & Remediation | Endor Labs](/content/learn/fixed-is-better-than-found-upgrades-remediation-with-endor-labs.html): At Endor Labs, we believe your application security tooling must go beyond alerting—it should also helpyou fast-track remediation. (535 words)
- [use-cases/fedramp/index.html](/content/use-cases/fedramp/index.html) (676 words)
- [PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs](/content/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619.html): PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (835 words)
- [BAAI/bge-small-en-v1.5 | Endor Labs](/content/ai-model/baai-bge-small-en-v1-5/index.html): BAAI/bge-small-en-v1.5 AI model with 63262721 downloads (215 words)
- [People AI Transforms Security And Compliance With Endor Labs… | Endor Labs](/content/learn/people-ai-transforms-security-and-compliance-with-endor-labs.html): Read People AI Transforms Security And Compliance With Endor Labs and learn practical strategies for application security, risk prioritization, and… (1,169 words)
- [Everything You Need To Know About The FedRAMP RFC-0012 | Endor Labs](/content/learn/everything-you-need-to-know-about-the-fedramp-rfc-0012.html): The new FedRAMP RFC shifts the standard to require deep context into the reachability and exploitability of vulnerabilities. Here’s what you need to know. (724 words)
- [com.fasterxml.jackson.core:jackson-databind 2.9.3 | Endor Labs](/content/version/66900d8393d667780a3e6712/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.9.3, plus known vulnerabilities and Endor Patches. (214 words)
- [Open Source Licensing Simplified: A Comparative Overview of Popular Licenses | Endor Labs](/content/learn/open-source-licensing-simplified-a-comparative-overview-of-popular-licenses.html): Explore the different types of open source licenses and how they impact the use, modification, and distribution of open source software. From GPL to Apache, MIT and more, learn the key differences between permissive and restrictive licenses and how to choose the right one for your project. (1,206 words)
- [com.fasterxml.jackson.core:jackson-databind 2.11.4 | Endor Labs](/content/version/6760e513bd91bc29bf6d0fac/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.11.4, plus known vulnerabilities and Endor Patches. (202 words)
- [sentence-transformers/all-MiniLM-L6-v2 | Endor Labs](/content/ai-model/sentence-transformers-all-minilm-l6-v2/index.html): sentence-transformers/all-MiniLM-L6-v2 AI model with 242677197 downloads (265 words)
- [Qwen/Qwen3-0.6B | Endor Labs](/content/ai-model/qwen-qwen3-0-6b/index.html): Qwen/Qwen3-0.6B AI model with 30037022 downloads (213 words)
- [gstreamer  | Endor Labs](/content/version/634b5935cf5bfc02132fa0fb/index.html): Security, activity, popularity and quality scores for gstreamer , plus known vulnerabilities and Endor Patches. (392 words)
- [com.fasterxml.jackson.core:jackson-databind 2.13.0 | Endor Labs](/content/version/6760e511bd91bc29bf6d0fa1/index.html): Security, activity, popularity and quality scores for com.fasterxml.jackson.core:jackson-databind 2.13.0, plus known vulnerabilities and Endor Patches. (185 words)
- [cross-encoder/ms-marco-MiniLM-L6-v2 | Endor Labs](/content/ai-model/cross-encoder-ms-marco-minilm-l6-v2/index.html): cross-encoder/ms-marco-MiniLM-L6-v2 AI model with 86477450 downloads (228 words)
- [Proactive Protection from Malware Attacks | Endor Labs](/content/learn/proactive-protection-from-malware-attacks/index.html): Protect your software supply chain from rising malware attacks. Endor Labs blocks malicious open-source dependencies early and reduces incident response. (469 words)
- [Malware Defense: A multi-agent detection engine and package firewall | Endor Labs](/content/learn/malware-defense-a-multi-agent-detection-engine-and-package-firewall.html): Open source malware doesn't wait for a CVE. Neither should your defenses. (288 words)
- [Your model, our analysis: BYOK for Endor Labs AI SAST | Endor Labs](/content/learn/byok-for-endor-labs/index.html): Your model, our analysis: BYOK for Endor Labs AI SAST (1,516 words)
- [Why Endor Labs AI SAST for C finds what other tools miss | Endor Labs](/content/learn/why-endor-labs-ai-sast-for-c-finds-what-other-tools-miss.html): Endor Labs AI SAST now fully supports C. Scans run in the IDE and on the PR, catching vulnerabilities before code ships, for teams writing C faster than release-gated review can keep up. (1,109 words)
- [learn/malware-in-open-source-ecosystems/index.html](/content/learn/malware-in-open-source-ecosystems/index.html) (503 words)
- [learn/state-of-dependency-management-2025/index.html](/content/learn/state-of-dependency-management-2025/index.html) (625 words)
- [CVE-2025-47949 Reveals Flaw in samlify That Opens Door to SAML Single Sign-On Bypass | Endor Labs](/content/learn/cve-2025-47949-reveals-flaw-in-samlify-that-opens-door-to-saml-single-sign-on-bypass.html): Information on the likelihood and impact of CVE-2025-47949 (758 words)
- [use-cases/container-scanning/index.html](/content/use-cases/container-scanning/index.html) (728 words)
- [Malicious Package Detection | Endor Labs](/content/use-cases/malware-detection/index.html): Detect and block software supply chain attacks. Evaluate package health with 150+ signals, find malicious dependencies and enforce policy. (519 words)
- [learn/secret-detection/index.html](/content/learn/secret-detection/index.html) (241 words)
- [Cursor Security: How to Secure AI-Generated Code in 2026 | Endor Labs](/content/learn/cursor-security/index.html): Cursor security covers IDE-level protections like Privacy Mode and SOC 2. Learn the 7 AI code generation risks these controls miss and how to fix them. (2,096 words)
- [How the EU Cyber Resilience Act (CRA) rewrites the rules of software liability | Endor Labs](/content/learn/20how-the-eu-cyber-resilience-act-cra-rewrites-the-rules-of-software-liability.html): The EU Cyber Resilience Act shifts software liability to vendors, requiring continuous vulnerability management and security updates across the product lifecycle. (1,593 words)
- [Fireside Chat: CISOs on AI, Shift Left, and Building Trust at People.ai and AppLovin | Endor Labs](/content/learn/fireside-chat-cisos-on-ai-shift-left-and-building-trust-at-people-ai-and-applovin.html): Learn how top security leaders think about using AI code assistants to achieve the shift-left dream, increase release velocity, and build developer trust. (640 words)
- [How To Evaluate Secret Detection Tools | Endor Labs](/content/learn/how-to-evaluate-secret-detection-tools/index.html): An overview of 3 requirements for a secret detection program, and how to do it with Endor Labs. (1,508 words)
- [Endor Labs + Zscaler: Zero Trust Application Security for the AI Era | Endor Labs](/content/learn/endor-labs-zscaler-zero-trust-application-security-for-the-ai-era.html): Endor Labs has partnered with Zscaler to bring Zero Trust to the AI-native software supply chain (1,260 words)
- [integrations/zscaler/index.html](/content/integrations/zscaler/index.html) (1,252 words)
- [Container Layer Analysis: Clarity in Remediation | Endor Labs](/content/learn/container-layer-analysis-clarity-in-remediation/index.html): Container layer analysis tells you which layer contains a vulnerability so you can prioritize remediation efforts more effectively and meet SLAs like FedRAMP. (1,068 words)
- [Inside AURI: How Endor Labs secures the agentic SDLC  | Endor Labs](/content/events/how-endor-labs-secures-the-agentic-sdlc/index.html) (408 words)
- [Combining EPSS and Reachability Analysis to Optimize Vulnerability Management | Endor Labs](/content/learn/epss-exploit-prediction-reachability-analysis/index.html): Exploit Prediction Scoring Systems (EPSS) is a data set that helps you understand the likelihood that a CVE will be exploited. Learn what the EPSS includes and how to use it to prioritize vulnerability remediation. (1,407 words)
- [integrations/upwind/index.html](/content/integrations/upwind/index.html) (3,642 words)
- [What You Need to Know About Apache Struts and CVE-2023-50164 | Endor Labs](/content/learn/what-you-need-to-know-about-apache-struts-and-cve-2023-50164.html): Discover the critical details of CVE-2023-50164, a severe vulnerability in Apache Struts. (660 words)
- [integrations/oligo/index.html](/content/integrations/oligo/index.html) (631 words)
- [integrations/stackhawk/index.html](/content/integrations/stackhawk/index.html) (524 words)
- [Introducing the Endor Labs MCP Server: fix-first security for the vibe coding era | Endor Labs](/content/learn/fix-first-security-for-the-vibe-coding-era/index.html): Endor Labs MCP Server powers real security fixes for vibe coding and AI-generated code—reduce noise and help AI tools fix risks for you. (682 words)
- [Under the Hood: People.ai's Proactive Approach to AI Security | Endor Labs](/content/learn/under-the-hood-people-ais-proactive-approach-to-ai-security.html): Hear how a CISO at an AI-first company is thinking about securing AI, and how AI should improve security programs. (1,212 words)
- [Structuring Prompts for Secure Code Generation | Endor Labs](/content/learn/structuring-prompts-for-secure-code-generation/index.html): A practical guide to embedding security requirements into AI coding workflows (726 words)
- [Beyond Mythos: A CISO's Guide to Building an Effective Software Security Program for the AI Era | Endor Labs](/content/learn/mythos-ciso-guide-to-building-effective-software-security-program-for-ai-era.html): Anthropic's Claude Mythos disclosure has every security leader asking the same question: what now? (268 words)
- [Endor Labs & Oligo: Closing the Loop Between Secure Code and Secure Runtime | Endor Labs](/content/learn/endor-labs-oligo-closing-the-loop-between-secure-code-and-secure-runtime.html): Endor Labs and Oligo keep pipelines fast and secure with unified reachability, real-time threat blocking, and safe, automatic fixes. (632 words)
- [integrations/nucleus/index.html](/content/integrations/nucleus/index.html) (811 words)
- [integrations/google/index.html](/content/integrations/google/index.html) (677 words)
- [integrations/microsoft/index.html](/content/integrations/microsoft/index.html) (310 words)
- [Endor Labs Now Available on Google Cloud Marketplace | Endor Labs](/content/learn/endor-labs-now-available-on-google-cloud-marketplace.html): Endor Labs is now available on the Google Cloud Marketplace, enabling faster procurement and deployment of software supply chain security for GCP customers and partners. (480 words)
- [integrations/google-antigravity/index.html](/content/integrations/google-antigravity/index.html) (434 words)
- [integrations/gitguardian/index.html](/content/integrations/gitguardian/index.html) (367 words)
- [integrations/cloudsmith/index.html](/content/integrations/cloudsmith/index.html) (751 words)
- [use-cases/code-scanning/index.html](/content/use-cases/code-scanning/index.html) (775 words)
- [Beyond MCP: The New Security Playbook for Coding Agents | Endor Labs](/content/learn/beyond-mcp-the-new-security-playbook-for-coding-agents.html): Beyond MCP: The New Security Playbook for Coding Agents (3,063 words)
- [integrations/cyberhaven/index.html](/content/integrations/cyberhaven/index.html) (389 words)
- [Zebra Technologies Cuts SCA Noise by 97% with Endor Labs | Endor Labs](/content/learn/zebra-technologies-cuts-sca-noise-by-97-with-endor-labs.html): With fewer alerts and more accuracy, Zebra Technologies now spends more time building and less time chasing false positives. (655 words)
- [integrations/brinqa/index.html](/content/integrations/brinqa/index.html) (535 words)
- [integrations/chainguard/index.html](/content/integrations/chainguard/index.html) (453 words)
- [integrations/buildkite/index.html](/content/integrations/buildkite/index.html) (456 words)
- [learn/npm-axios-compromise/index.html](/content/learn/npm-axios-compromise/index.html) (823 words)
- [Critical Security Controls for Governing AI Coding Agents | Endor Labs](/content/learn/critical-controls-coding-agents/index.html): Six places to enforce AI coding agent governance on the developer's machine, and why in-agent hooks are the one deterministic control between intent and action. (1,478 words)
- [use-cases/secrets-detection/index.html](/content/use-cases/secrets-detection/index.html) (697 words)
- [OSS Vulnerabilities And The Digital Operational Resilience… | Endor Labs](/content/learn/oss-vulnerabilities-and-the-digital-operational-resilience-act-dora-compliance.html): Read Oss Vulnerabilities And The Digital Operational Resilience Act Dora Compliance and learn practical strategies for application security, risk… (2,006 words)
- [integrations/python-language/index.html](/content/integrations/python-language/index.html) (2,180 words)
- [Container Scanning + SCA = Better Together | Endor Labs](/content/learn/container-scanning-sca-better-together/index.html): We’re excited to announce that Endor Labs now extends our software supply chain platform to include container scanning. (2,254 words)
- [integrations/typescript-language/index.html](/content/integrations/typescript-language/index.html) (839 words)
- [integrations/slack/index.html](/content/integrations/slack/index.html) (1,791 words)
- [integrations/jira/index.html](/content/integrations/jira/index.html) (1,407 words)
- [Build vs. Buy Code Security: Same Model, Same Tasks, 12x the Token Bill | Endor Labs](/content/learn/the-token-economics-of-using-ai-coding-agents-for-security-tasks.html): Same model, same security tasks. One agent burned 79.5M tokens, the other 6.6M. The only difference was deterministic context. Here's the benchmark, and why a pure-LLM AppSec stack costs 12x more than a hybrid one. (1,442 words)
- [integrations/javascript-language/index.html](/content/integrations/javascript-language/index.html) (1,544 words)
- [The Great Indonesian TEA Theft: Analyzing a NPM Spam Campaign | Endor Labs](/content/learn/the-great-indonesian-tea-theft-analyzing-a-npm-spam-campaign.html): How a sophisticated spam campaign hijacked popular NPM packages with Indonesian food names as part of a global software supply chain attack. (1,912 words)
- [Introducing A Better Way To SCA For Monorepos And Bazel |… | Endor Labs](/content/learn/introducing-a-better-way-to-sca-for-monorepos-and-bazel.html): Read Introducing A Better Way To Sca For Monorepos And Bazel and learn practical strategies for application security, risk prioritization, and faster… (1,114 words)
- [5 Tips for Managing Bazel Dependencies (Without Losing Friends) | Endor Labs](/content/learn/5-tips-for-managing-bazel-dependencies-without-losing-friends.html): Upgrading dependencies in a Bazel monorepo? Learn 5 tips to avoid breakages, reduce risk, and keep your team (and builds) running smoothly. (1,737 words)
- [Your Git Repo Is a Software Supply Chain Risk | Endor Labs](/content/learn/your-git-repo-is-a-supply-chain-risk/index.html): Read Your Git Repo Is A Supply Chain Risk and learn practical strategies for application security, risk prioritization, and faster remediation in modern… (1,274 words)
- [integrations/vanta/index.html](/content/integrations/vanta/index.html) (868 words)
- [integrations/bitbucket/index.html](/content/integrations/bitbucket/index.html) (874 words)
- [Introducing Full Stack Reachability: Container Scanning That Actually Reduces Noise | Endor Labs](/content/learn/introducing-full-stack-reachability-container-scanning-that-actually-reduces-noise.html): Cut container vulnerability noise by up to 90% with full-stack reachability analysis spanning application and container image OS layers. (1,819 words)
- [integrations/ide/index.html](/content/integrations/ide/index.html) (575 words)
- [GitHub Action tj-actions/changed-files supply chain attack: what you need to know | Endor Labs](/content/learn/github-action-tj-actions-changed-files-supply-chain-attack-what-you-need-to-know.html): GitHub Action tj-actions/changed-files was compromised, exposing CI/CD secrets. Learn how this attack impacts repositories and what steps to take now. (777 words)
- [integrations/golang-language/index.html](/content/integrations/golang-language/index.html) (1,001 words)
- [Streamline Investigation with Enriched Vulnerability Search | Endor Labs](/content/learn/streamline-investigation-with-enriched-vulnerability-search.html): Endor Labs Vulnerability Search helps you investigate CVEs with enriched metadata, call paths, and precise impact analysis—resolving conflicts across public feeds. (548 words)
- [VMware Achieves SBOM Compliance for Over 100 Services with Endor Labs | Endor Labs](/content/learn/vmware-endor-labs-case-study/index.html): Learn how the VMWare compliance team built a a scalable process to collect and attest to SBOMs using Endor Labs. (810 words)
- [Rubrik Hits Aggressive SLAs via Endor Labs | Endor Labs](/content/learn/rubrik-hits-aggressive-slas-via-endor-labs/index.html): Rubrik uses Endor Labs for application security, including: SCA, SAST, container scanning, and secret detection. (1,262 words)
- [Code Scanning | Application Security | Endor Labs](/content/use-case/code-scanning/index.html): Endor Labs brings together Reachability-Based SCA, SAST, Secrets, CI/CD, and Container Scanning in a single, remediation-focused platform. (780 words)
- [AI Model Governance](/content/use-case/ai-model-governance/index.html): Govern open source AI models like any other dependency. Discover, evaluate and enforce policy on the models your developers pull into production. (641 words)
- [integrations/cursor/index.html](/content/integrations/cursor/index.html) (275 words)
- [integrations/ruby-language/index.html](/content/integrations/ruby-language/index.html) (680 words)
- [Reduce FedRAMP Compliance Costs | Endor Labs](/content/learn/reduce-fedramp-compliance-costs/index.html): Endor Labs reduces false positives and prioritizes real vulnerabilities, helping your team meet FedRAMP requirements with less stress and lower costs. (525 words)
- [Endor Labs vs Semgrep Comparison | Application Security | Endor Labs](/content/lp/semgrep/index.html): Explore this resource to learn how application security helps teams reduce noise, prioritize real risk, and remediate faster across the SDLC. (376 words)
- [State Of Dependency Management 2025 | Application Security |…](/content/lp/state-of-dependency-management-2025/index.html): Explore this resource to learn how application security helps teams reduce noise, prioritize real risk, and remediate faster across the SDLC. (546 words)
- [Achieving FedRAMP’s Container Scanning Requirements | Endor Labs](/content/learn/achieving-fedramps-container-scanning-requirements/index.html): ConMon costs for container security can be high due to FedRAMP’s unique requirements. Learn about these requirements and how to avoid common pitfalls like “double filings.” (895 words)
- [integrations/gemini/index.html](/content/integrations/gemini/index.html) (316 words)
- [Endor Labs, #1 Snyk Alternative](/content/compare/endor-labs-vs-snyk/index.html): Compare Endor Labs with Snyk for securing code, open source dependencies, and AI-generated software. (346 words)
- [Give Your AI Coding Assistants the Security Tools They Deserve (2026) | Endor Labs](/content/events/give-ai-coding-assistants-security-tools-they-deserve-webinar.html): In this short webinar, we take a look at how Endor Labs is enhancing our Static Analysis to both use and serve AI Agents as part of our AURI multi-agent platform. We’ll give you a quick overview of what we've done, and demo of how it works. (185 words)
- [use-case/reachability-sca/index.html](/content/use-case/reachability-sca/index.html) (644 words)
- [A Practitioner’s Guide to Responding to the TeamPCP Supply Chain Attacks | Endor Labs](/content/learn/a-practitioners-guide-to-responding-to-the-teampcp-supply-chain-attacks.html): Investigating, remediating, and hardening your environment in the wake of the TeamPCP campaign — from an organization that went through the process itself. (255 words)
- [Remote Code Execution Vulnerabilities in Apache Struts | Endor Labs](/content/learn/remote-code-execution-vulnerabilities-in-apache-struts.html): CVE-2024-53677 and CVE-2023-50164 are vulnerabilities in Apache Struts that could pave the way for remote code execution, or RCE. Learn how to figure out if you’re affected, and if so what to do about it (1,163 words)
- [Endor Labs vs Traditional SCA | Application Security…](/content/compare/endor-labs-vs-traditional-sca/index.html): Compare Endor Labs with other application security tools for securing code, open source dependencies, and AI-generated software. (297 words)
- [use-cases/sast/index.html](/content/use-cases/sast/index.html) (742 words)
- [integrations/claude/index.html](/content/integrations/claude/index.html) (295 words)
- [LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials | Endor Labs](/content/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials.html): A malicious build of LiteLLM 1.107.0 shipped to PyPI and container registries with Python startup hooks that steal credentials on every interpreter launch, including LiteLLM's own stored provider keys. The payload runs without the application ever importing LiteLLM. (1,877 words)
- [Threat Center and Package Firewall for VS Code Extensions | Endor Labs](/content/learn/introducing-threat-center-and-package-firewall-for-vs-code-extensions-malware-protection-from-the-registry-to-the-developer-workstation.html): Threat Center and Package Firewall for VS Code Extensions (666 words)
- [learn/ci-cd/index.html](/content/learn/ci-cd/index.html) (238 words)
- [Improve Kubernetes Security with Signed Artifacts and Admission Controllers | Endor Labs](/content/learn/improve-kubernetes-security-with-signed-artifacts-and-admission-controllers.html): Control which images get deployed in Kubernetes by configuring an admission controller to admit only those which have been signed by Endor Labs. (885 words)
- [eMudhra CA Compromise: The Trust Stores You Didn't Patch | Endor Labs](/content/learn/emudhra-intermediate-ca-compromise-the-trust-stores-you-patched-and-the-ones-you-didnt-know-you-had.html): Eight eMudhra intermediate CA keys are compromised and browsers are already protected. Non-browser clients and libraries with bundled trust stores are not. (2,636 words)
- [tools/calculator/index.html](/content/tools/calculator/index.html) (744 words)
- [Vulnerability Reporting Transparency | Endor Labs](/content/research/vulnerability-reporting-transparency/index.html): When reporting vulnerabilities in open source projects, Endor Labs follows the 90+30 disclosure policy from Google Project Zero. This page tracks all active and completed vulnerability reports by the Endor Labs security research team. (498 words)
- [Threat Research: CVEs & Drop-in Patches | Endor Labs](/content/research/threat-research/index.html): Learn more about CVEs with reachability and exploitability context, plus drop-in patches that let you fix vulnerabilities without upgrading. (245 words)
- [Supply Chain Risk: Packages & AI Models | Endor Labs](/content/research/supply-chain-risk/index.html): Learn more about the security, license, and operational risks of the open source packages and AI models entering your codebase through dependencies. (183 words)
- [AI Coding Agent Security Benchmark | Endor Labs](/content/research/ai-code-security-benchmark/index.html): The Agent Security League is an open benchmark tracking the functional and security correctness of popular AI coding agents across real-world tasks. (487 words)
- [AppSec for Software & Technology Companies | Endor Labs](/content/industry/software-technology/index.html): Endor Labs gives software companies AppSec that moves at the speed of engineering: reachability cuts noise to what's real, fixes ship with the code, and compliance evidence flows automatically. (827 words)
- [OWASP Top 10 Risks for Open Source | Endor Labs](/content/learn/top-10-open-source-risks/index.html): Emerging trends impacting open source dependency management (628 words)
- [AppSec for Financial Services | Endor Labs](/content/use-case/financial-services/index.html): Endor Labs gives financial services teams agentic remediation, logic-flaw detection, and AI coding agent governance — hit SLAs without breaking core platforms. (875 words)
- [Reduce SOC 2 Compliance Burden with Endor Labs | Agentic AppSec Platform](/content/use-case/soc2/index.html): Get SCA, SAST, secrets detection, and container scanning in one platform, so you can stand up a SOC 2-ready AppSec program without adding headcount or slowing down your developers. (767 words)
- [Reduce PCI DSS Compliance Burden with Endor Labs | Agentic AppSec Platform](/content/use-case/pci-dss/index.html): PCI DSS compliance creates developer friction. Endor Labs cuts noise so your team fixes only reachable vulnerabilities, with the evidence required by assessors. (807 words)
- [Context Engineering for Application Security | Endor Labs](/content/learn/context-engineering-for-application-security/index.html): Why security tools fail on AI-generated code, and what changes when you engineer context instead of adding rules. Read the Endor Labs white paper. (3,331 words)
- [Reduce ISO 42001 Compliance Burden with Endor Labs | Agentic AppSec Platform](/content/use-case/iso-42001/index.html): ISO 42001 compliance creates developer friction. Endor Labs cuts noise so your team fixes only reachable vulnerabilities, with the SBOM evidence required. (684 words)
- [Reduce FedRAMP Compliance Burden with Endor Labs | Agentic AppSec Platform](/content/use-case/fedramp/index.html): FedRAMP compliance creates developer friction. Endor Labs cuts noise so your team fixes only reachable vulnerabilities, with the evidence 3PAOs require. (778 words)
- [Reduce Cyber Resilience Act (CRA) Compliance Burden with Endor Labs | Agentic AppSec Platform](/content/use-case/cyber-resilience-act/index.html): CRA compliance creates developer friction. Endor Labs cuts noise so your team fixes only reachable vulnerabilities, with the SBOM evidence required. (796 words)
- [Upgrades Remediation | Application Security | Endor Labs](/content/use-case/upgrades-remediation/index.html): Fix CVEs 6.2x faster without breaking changes. Understand upgrade impact, prioritize by complexity, and patch when upgrading isn't possible. (365 words)
- [use-cases/compliance-and-sbom/index.html](/content/use-cases/compliance-and-sbom/index.html) (345 words)
- [Software Supply Chain Security | Endor Labs](/content/solutions/software-supply-chain-security/index.html): One platform for reachability-based prioritization, agentic remediation, real-time malware blocking, and GitHub Actions security across the software supply chain. (780 words)
- [AI Code Security | Security and Governance for AI-Generated Code | Endor Labs](/content/solutions/ai-code-security/index.html): Govern AI coding agents, generate secure code by default, and quickly find and fix what slips through. One control system for the entire agentic SDLC. (787 words)
- [use-cases/reachability-sca/index.html](/content/use-cases/reachability-sca/index.html) (560 words)
- [learn/open-source/index.html](/content/learn/open-source/index.html) (228 words)
- [SBOM Hub & VEX | Software Transparency & Compliance | Endor Labs](/content/use-case/sbom-hub-vex/index.html): One place to ingest, generate, and continuously monitor every first- and third-party SBOM and VEX, with reachability-based justification for what matters. (647 words)
- [Endor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Endor Labs](/content/learn/endor-labs-ai-sast-finds-zero-day-cve-2026-55407-buffa.html): We identified an unbounded-allocation data flow in buffa's protobuf decoder that I developed into a ~22x memory-amplification denial of service for CVE-2026-55407 (1,624 words)
- [Container Scanning | Application Security | Endor…](/content/use-case/container-scanning/index.html): Endor Labs uses full-stack reachability analysis to help you patch what runs and prune the rest. (694 words)
- [Endor Patches | Fix CVEs Without Upgrading | Endor Labs](/content/use-case/endor-patches/index.html): Endor Patches backport the upstream security fix to the version you already run — minimal, reproducible, audit-ready — so you close CVEs without an upgrade. (682 words)
- [Malware Detection | Application Security | Endor Labs](/content/use-case/malicious-package-detection/index.html): Stop open source malware before it runs. Scan every package across the IDE, CI and your apps, with findings verified by Endor Labs researchers. (761 words)
- [SCA with Reachability | Fix Only Exploitable CVEs | Endor Labs](/content/use-case/sca-with-reachability/index.html): Endor Labs SCA uses function-level reachability to show which open source vulnerabilities are actually exploitable in your code — cutting findings by 92%. (627 words)
- [AI SAST: Code Security for the Agentic SDLC | Endor Labs](/content/learn/ai-sast-code-security-for-the-agentic-sdlc/index.html): How Endor Labs AI SAST combines program analysis, agentic reasoning, and deterministic engineering to find and fix the flaws that matter in AI-written code. (307 words)
- [integrations/armorcode/index.html](/content/integrations/armorcode/index.html) (933 words)
- [AI Security Review | Catch the Risk in Every PR | Endor Labs](/content/use-case/ai-security-review/index.html): AI Security Review catches the vulnerabilities rule-based scanners miss, from broken access control to insecure design, and ships a fix on every pull request. (904 words)
- [AI SAST: Catch Logic and Design Flaws AI Introduces | Endor Labs](/content/use-case/ai-sast/index.html): Traditional SAST misses the design and logic flaws AI-generated code introduces. See how Endor Labs finds what pattern matching cannot. (723 words)
- [Secrets Detection | Application Security | Endor Labs](/content/use-case/secrets-detection/index.html): Consolidate secret scanning with SAST and SCA to catch leaked API keys, credentials, and tokens before they reach production. (633 words)
- [use-cases/ai-code-governance/index.html](/content/use-cases/ai-code-governance/index.html) (805 words)
- [Coding Agent Governance | Endor Labs](/content/use-case/coding-agent-governance/index.html): Discover and govern coding agents, models, MCP servers, and skills. Block risky actions and packages in real time, and secure AI-generated code from one platform. (622 words)
- [AI in AppSec: What to Build vs. Buy | Endor Labs](/content/learn/what-to-build-and-buy-when-you-bring-ai-into-appsec.html): Building AI security agents in-house? Learn what to build, what to buy, and what it costs at scale, with a four-level model for the agentic SDLC. (2,089 words)
- [Secure AI Coding by Default: Free MCP Server | Endor Labs](/content/platform/developer/index.html): Guide coding agents to write secure code from the first prompt. Install the free Endor Labs MCP server and shift security into generation, not review. (1,153 words)
- [Agentic Workflows | Endor Labs](/content/platform/agentic-workflows/index.html): Agentic workflows for remediation, triage, and investigation that run in the coding agents your developers already use, powered by Endor Labs context., Explore our platform (1,126 words)

## Products

- [SBOM Hub | Application Security | Endor Labs](/content/product/endor-labs-sbom-hub/index.html): Explore application security capabilities designed to reduce noise, prioritize real risk, and help teams remediate vulnerabilities faster. (455 words)
- [CI CD Security | Application Security | Endor Labs](/content/product/endor-labs-ci-cd/index.html): Secure your CI/CD pipelines with Endor Labs by discovering pipeline tools, detecting repo misconfigurations, and verifying build integrity. (926 words)

## Resources

- [Full Page Index](/index.html): Browse all cached pages with rich metadata
- [About This Cache](/about.html): Methodology, technical details, and usage guidelines
- [XML Sitemap](/sitemap.xml): Machine-readable sitemap for crawler discovery
- [Robots.txt](/robots.txt): Crawler directives
- [Agentsite Network](https://agentsite.network/network.html): Public index of Agentsites and their machine-readable resources