https://pumasecurity.io/resources/category/blog/ Security research, vulnerability disclosures, and .NET and cloud security guidance from Puma Security. en-us Tue, 18 Aug 2026 18:51:18 -0500 Jekyll v3.7.4 https://pumasecurity.io/img/puma-logo.png https://pumasecurity.io/resources/category/blog/ https://pumasecurity.io/resources/blog/foreup-api-payment-credential-exposure-bola/ https://pumasecurity.io/resources/blog/foreup-api-payment-credential-exposure-bola/ Sat, 01 Aug 2026 00:00:00 -0500Two foreUP API flaws, CVE-2026-15657 and CVE-2026-15658, exposed a golf club's payment processor credentials and member records. Full disclosure timeline. Eric Mead Blog https://pumasecurity.io/resources/blog/puma-scan-claude-skill/ https://pumasecurity.io/resources/blog/puma-scan-claude-skill/ Tue, 21 Apr 2026 00:00:00 -0500Install the new Puma Scan Claude Skill to let AI agents scan C# projects with Puma Scan Server Edition CLI, triage findings, and fix vulnerabilities. Eric Johnson Blog https://pumasecurity.io/resources/blog/teampcp-github-actions-supply-chain/ https://pumasecurity.io/resources/blog/teampcp-github-actions-supply-chain/ Fri, 27 Mar 2026 00:00:00 -0500Learn how TeamPCP exploited mutable GitHub Action tags to compromise Trivy, Checkmarx, and LiteLLM, and how to protect your CI/CD pipelines. Eric Johnson Blog https://pumasecurity.io/resources/blog/puma-scan-vs-sonarqube-dotnet-sast/ https://pumasecurity.io/resources/blog/puma-scan-vs-sonarqube-dotnet-sast/ Wed, 25 Mar 2026 00:00:00 -0500Compare Puma Scan and SonarQube for .NET and C# static analysis. See how real-time IDE scanning, taint analysis, pricing, and CI/CD integration differ between these two SAST tools. Eric Mead Blog https://pumasecurity.io/resources/blog/aws-outbound-identity-federation/ https://pumasecurity.io/resources/blog/aws-outbound-identity-federation/ Thu, 18 Dec 2025 00:00:00 -0600Configure AWS IAM Outbound Identity Federation to access Azure resources from EC2 instances using OIDC tokens and Nymeria. Eric Johnson Blog https://pumasecurity.io/resources/blog/rsac-2025-kubernetes-workload-identity/ https://pumasecurity.io/resources/blog/rsac-2025-kubernetes-workload-identity/ Mon, 05 May 2025 00:00:00 -0500RSAC 2025 sessions on securing Kubernetes workload identity across AWS EKS, Azure AKS, and Google GKE with OIDC federation. Eric Johnson Blog https://pumasecurity.io/resources/blog/auditing-eks-pod-permissions/ https://pumasecurity.io/resources/blog/auditing-eks-pod-permissions/ Thu, 29 Feb 2024 00:00:00 -0600Three methods for auditing AWS EKS pod IAM permissions, from node roles to IRSA and EKS Pod Identity for least-privilege access. Eric Johnson Blog https://pumasecurity.io/resources/blog/RSAC-2023-Nymeria-Destroying-Long-Lived-Credentials-Workload-Identity-Federation/ https://pumasecurity.io/resources/blog/RSAC-2023-Nymeria-Destroying-Long-Lived-Credentials-Workload-Identity-Federation/ Mon, 01 May 2023 00:00:00 -0500RSAC 2023 session on eliminating long-lived cloud credentials using OpenID Connect and workload identity federation across cloud providers. Eric Johnson Blog https://pumasecurity.io/resources/blog/hth-2022-cloud-security-village/ https://pumasecurity.io/resources/blog/hth-2022-cloud-security-village/ Thu, 03 Nov 2022 00:00:00 -0500Hands-on cloud security village from HTH 2022: compromise serverless functions across AWS, Azure, and Google Cloud providers. Eric Johnson Blog https://pumasecurity.io/resources/blog/RSAC-2020-Defending-Serverless-Infrastructure-in-the-Cloud/ https://pumasecurity.io/resources/blog/RSAC-2020-Defending-Serverless-Infrastructure-in-the-Cloud/ Mon, 02 Mar 2020 00:00:00 -0600RSAC 2020 takeaways on defending serverless infrastructure, securing public cloud resources, and hardening multi-cloud environments. Eric Johnson Blog https://pumasecurity.io/resources/blog/infosec-podcast/ https://pumasecurity.io/resources/blog/infosec-podcast/ Mon, 03 Feb 2020 00:00:00 -0600Eric Johnson discusses building a career in application security, transitioning from development, and founding Puma Security. Eric Johnson Blog https://pumasecurity.io/resources/blog/contributing-to-puma-scan-community-edition/ https://pumasecurity.io/resources/blog/contributing-to-puma-scan-community-edition/ Wed, 29 Jan 2020 00:00:00 -0600Step-by-step guide to contributing custom security rules to the Puma Scan Community Edition open source project using Roslyn analyzers. Eric Mead Blog https://pumasecurity.io/resources/blog/cloud-security-instance-metadata/ https://pumasecurity.io/resources/blog/cloud-security-instance-metadata/ Wed, 09 Oct 2019 00:00:00 -0500How attackers exploit the AWS Instance Metadata Service through SSRF attacks, and what the Capital One breach revealed about cloud security. Eric Johnson Blog https://pumasecurity.io/resources/blog/DevSecOps-Key-Controls-for-Modern-Security-Success/ https://pumasecurity.io/resources/blog/DevSecOps-Key-Controls-for-Modern-Security-Success/ Sat, 06 Apr 2019 00:00:00 -0500Key DevSecOps controls for cloud security success, covering pre-commit, CI/CD pipelines, supply chain security, and acceptance testing. Eric Johnson Blog https://pumasecurity.io/resources/blog/what-to-do-and-what-to-avoid-when-implementing-security-in-the-devops-lifecycle/ https://pumasecurity.io/resources/blog/what-to-do-and-what-to-avoid-when-implementing-security-in-the-devops-lifecycle/ Tue, 02 Oct 2018 00:00:00 -0500DevSecOps experts share what to do and avoid when implementing security in the DevOps lifecycle, including culture and tooling advice. David Bisson Blog https://pumasecurity.io/resources/blog/weaponizing-your-devops-pipeline/ https://pumasecurity.io/resources/blog/weaponizing-your-devops-pipeline/ Tue, 31 Jul 2018 00:00:00 -0500Learn how to add security controls across your DevOps pipeline, from pre-commit to production, to reduce remediation time. Eric Johnson Blog https://pumasecurity.io/resources/blog/5-tips-for-getting-started-with-DevSecOps/ https://pumasecurity.io/resources/blog/5-tips-for-getting-started-with-DevSecOps/ Tue, 17 Jul 2018 00:00:00 -0500Five practical tips for building a DevSecOps program from the ground up, featuring expert advice from security engineer Eric Johnson. Blog https://pumasecurity.io/resources/blog/Secure-DevOps-Pumas-Tail/ https://pumasecurity.io/resources/blog/Secure-DevOps-Pumas-Tail/ Sun, 10 Jun 2018 00:00:00 -0500Explore how to integrate security into DevOps with pre-commit hooks, CI static analysis, and security testing best practices. Eric Johnson Blog https://pumasecurity.io/resources/blog/puma-scan-aspnet-install/ https://pumasecurity.io/resources/blog/puma-scan-aspnet-install/ Thu, 16 Nov 2017 00:00:00 -0600Our team recognizes the importance of security, but have yet to find reliable solutions that match the speed of our development process. That's where Puma Scan comes into the picture. Mitch Ostlund Blog https://pumasecurity.io/resources/blog/what-is-puma-scan/ https://pumasecurity.io/resources/blog/what-is-puma-scan/ Fri, 10 Nov 2017 00:00:00 -0600Discover what Puma Scan is, how it differs from other static analyzers, and why it provides real-time security analysis for .NET applications. Brooke Johnson Blog