MAZE HQ 2026 [TERMS] Privacy Policy window

The post How Cohere Health cleared 92% of its critical and high findings and got their time back appeared first on Maze.

Open-source packages are built into every application, and so are the countless vulnerabilities found in their direct and transitive dependencies. For years, SCA tools have been great at finding vulnerabilities but awful at telling you whether they're a p

There's a new key confusion bug in PyJWT that lets an attacker forge login tokens using nothing but your public key. With over 590 million downloads a month, PyJWT is the most downloaded JWT library in Python, and a lot of authentication sits on top of it

Opening a ticket is often the start of a very long process for a developer. Most of the work happens before any code changes. They have to prove what's exploitable, judge the real risk, and figure out the fix for each one. For teams that work in Jira, tho

Security teams lose 14.1 hours a week chasing false positives (Security Boulevard). That matches what we hear from customers, and it's because most scanner findings are safe to ignore. Knowing which findings are just noise is the hard part. Without contex

When you check out of an online store as a guest, using just your email, you'd expect your account to remain untouched until the next time you log in. That's how accounts are set up to work. But if that site has an account takeover vulnerability, bad acto

SAST tools promise to find your vulnerabilities and then bury you in false positives. This happens because they run on fixed rules and flag anything that matches a risky pattern, and most of it isn't real, so your team burns hours triaging the pile to fin

In November 2025, Anthropic disclosed that a threat actor had used Claude to orchestrate a cyber espionage campaign targeting roughly 30 organizations. The AI performed 80-90% of the work, with only four to six human decision points. Everything else was a

Langfuse has a setting called SSO enforcement, and it has one goal. Turn it on and nobody at your domain can log in except through your identity provider. Revoke a user in Okta at offboarding, and every other door closes. That sounds airtight. But it only

We launched two code security products last week, which is either brilliant or terrible timing depending on who you ask. It's not long since the market lost its mind over Anthropic launching a SAST product, triggering a wave of online chatter claiming tha