Denis Makrushin
  • Blog
  • Research
Denis Makrushin
  • Academynew
  • About
Blog

A small step in the large open-source: CVSS integration in Trivy

by Denis Makrushin August 16, 2025

At the heart of our AppSec platform is an open-source project called Trivy. It’s a software composition analysis tool that helps developers to detect issues in dependencies used in their code.

This time, we are not only integrating, but also contributing: in Trivy 0.65.0 release, our developer, Stepan Dolgintsev, added the CVSS vector support. This means that CVSS itself will soon appear on our Supply Chain page, enabling developers and AppSec engineers to triage vulnerabilities more accurately.

The Trivy team has acknowledged this contribution. Congratulations to Stepan on taking his first steps in the world of large open-source projects! Thanks also to Andrey Kuleshov for idea to propose the update to project maintainers.

August 16, 2025
TwitterLinkedinVKTelegramThreadsBluesky
Blog

Bot that collects security research and insights

by Denis Makrushin August 5, 2025

Back in 2020, when X was still called Twitter, I created a simple Telegram bot that analysed Twitter feeds and identified interesting ideas related to vulnerability detection. Every day, it analysed all the posts with the #bugbountytips hashtag from the previous 24 hours, selected the posts with the highest reach based on the number of likes and retweets, and published them to the feed.

Since then, Twitter has shut down its API and rebranded as X and implemented anti-scraping measures to block content harvesting. However, the number of valuable ideas and the size of security community on the platform have not decreased.

With a bit of vibe-coding, the bot can be brought back to life:

  • The bot uses Playwright to collect and analyse content on X with the hashtags #bugbountytips, #bugbountytip, #bugbounty, #pentest and #redteam that have received a certain number of likes within 24 hours.
  • The bot transmits these posts for analysis to the DeepSeek-V3 model, which parses each post and prepares an expert commentary.
  • It publishes the result in the @bhhub Telegram channel at 13:37 (UTC+0).

Link in comments. If you have any ideas for hashtags or sources to add for monitoring, please share them in the comments or via DM.

August 5, 2025
TwitterLinkedinVKTelegramThreadsBluesky
BlogResearch

Secret Ingredients for Secure Development: Achieving Fast and Accurate Secret Detection

by Denis Makrushin July 31, 2025

Finding secrets in code can be done quickly and accurately if you know their exact format and search within your own project. The task becomes significantly harder when scanning across multiple projects or an enterprise monorepo. The challenge becomes even bigger if the search area is a developer platform and your secret format is nondeterministic.

Effective secret detection and leak prevention during development are crucial for protecting projects from data breaches. The secret-scanning workflows presented here are designed for defensive use in trusted CI/CD pipelines. By combining lightning-fast push-protection scans with deeper, high-precision sweeps of large codebases, this approach enables defenders to find and revoke leaked credentials right at commit time or during routine audits. This gives them an advantage over any adversary scraping the codebase for sensitive data.

This article will walk you through the discovery phase for a secret analyzer. We’ll explore the latest secret scanning tools, understand their constraints, and identify ways to improve three key metrics of secret scanning: precision, recall, and speed.

Continue Reading
July 31, 2025
TwitterLinkedinVKTelegramThreadsBluesky
Load More Posts

Join Telegram Channel

  • Twitter
  • Linkedin
  • Vk
  • Telegram

@ 2009. Denis Makrushin


Back To Top
Denis Makrushin
  • Blog
  • Research
Denis Makrushin
  • Academynew
  • About