[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F16":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","16","Control 16","Application Software Security",770,"Center for Internet Security (CIS)","**What it asks for.** Organisations should manage the security life cycle of software they develop, host or acquire to prevent, detect and fix weaknesses before they cause harm. It covers secure development processes, third party components and vulnerability handling.\n\n**In practice.** Good practice includes a documented secure development process, threat modelling for significant changes, code review and automated testing such as static and dynamic analysis, and an inventory of third party components with tracking of their vulnerabilities. Developers receive secure coding training, environments are separated, and a process exists for receiving and fixing reported vulnerabilities. Evidence includes pipeline configurations, test results, component inventories and records of fixed vulnerabilities.\n\n**Common gaps.** Third party dependencies are often unmanaged and scan findings pile up without triage. Security testing tends to cover the main application while internal tools and scripts are ignored.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fapplication-software-security","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},795,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"fake-interview-assignments-weaponize-npm-packages-to-compromise-developer-machines","Fake Interview Assignments Weaponize npm Packages to Compromise Developer Machines","2026-11-13T18:21:36.396+00:00",{"slug":24,"title":25,"published_at":26},"ai-coding-agents-hijacked-via-poisoned-training-data-and-model-checkpoints","AI Coding Agents Hijacked via Poisoned Training Data and Model Checkpoints","2026-11-12T18:20:37.986+00:00",{"slug":28,"title":29,"published_at":30},"blank-access-key-bypass-in-third-party-rmm-plugin-enables-mass-malware-deployment","Blank Access Key Bypass in Third-Party RMM Plugin Enables Mass Malware Deployment","2026-11-12T15:22:36.11+00:00",{"slug":32,"title":33,"published_at":34},"client-side-supply-chain-attacks-bypass-all-traditional-security-controls","Client-Side Supply Chain Attacks Bypass All Traditional Security Controls","2026-11-12T15:22:17.578+00:00",{"slug":36,"title":37,"published_at":38},"60000-github-repos-poisoned-via-hijacked-accounts-and-workflow-injection","60,000 GitHub Repos Poisoned via Hijacked Accounts and Workflow Injection","2026-11-12T14:21:55.79+00:00",{"slug":40,"title":41,"published_at":42},"ai-coding-tools-become-supply-chain-attack-vectors-for-credential-theft","AI Coding Tools Become Supply Chain Attack Vectors for Credential Theft","2026-11-12T12:20:57.94+00:00",{"slug":44,"title":45,"published_at":46},"net-11-hardens-nuget-and-container-pipelines-against-supply-chain-attacks",".NET 11 Hardens NuGet and Container Pipelines Against Supply Chain Attacks","2026-11-12T09:20:38.657+00:00",{"slug":48,"title":49,"published_at":50},"ai-generated-code-fixes-can-introduce-new-vulnerabilities-without-human-oversight","AI-Generated Code Fixes Can Introduce New Vulnerabilities Without Human Oversight","2026-11-12T08:21:16.023+00:00",{"slug":52,"title":53,"published_at":54},"ai-coding-assistant-mcp-servers-expose-api-keys-via-poisoned-dependencies","AI Coding Assistant MCP Servers Expose API Keys via Poisoned Dependencies","2026-11-11T17:20:58.508+00:00",{"slug":56,"title":57,"published_at":58},"buggy-script-fatally-weakened-ca-private-keys-destroying-trust-in-emudhra","Buggy Script Fatally Weakened CA Private Keys, Destroying Trust in eMudhra","2026-11-11T14:20:46.892+00:00",{"slug":60,"title":61,"published_at":62},"infostealer-claims-to-maintain-gmail-access-beyond-password-resets","Infostealer Claims to Maintain Gmail Access Beyond Password Resets","2026-11-11T12:22:39.713+00:00",{"slug":64,"title":65,"published_at":66},"clickfix-social-engineering-evolves-to-hijack-domain-controllers-via-png-hidden-malware","ClickFix Social Engineering Evolves to Hijack Domain Controllers via PNG-Hidden Malware","2026-11-11T11:21:35.953+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",289,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",283,{"slug":79,"name":80,"problem":81,"stories":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",220,{"slug":84,"name":85,"problem":86,"stories":87},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",164,{"slug":89,"name":90,"problem":91,"stories":92},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",143,{"slug":94,"name":95,"problem":96,"stories":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",127,[99,105,110,116,121,127,132,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",326,{"family":5,"item":106,"code":107,"title":108,"together":109},"2","Control 2","Inventory and Control of Software Assets",317,{"family":111,"item":112,"code":113,"title":114,"together":115},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",297,{"family":5,"item":117,"code":118,"title":119,"together":120},"7","Control 7","Continuous Vulnerability Management",237,{"family":122,"item":123,"code":124,"title":125,"together":126},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",208,{"family":111,"item":128,"code":129,"title":130,"together":131},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",193,{"family":133,"item":123,"code":134,"title":134,"together":135},"itil","ITIL",182,{"family":137,"item":138,"code":139,"title":140,"together":141},"nist-800-53","ac-6","AC-6","Least Privilege",154]