DevSec Station
DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you level up.
Episodes
Two critical PHP vulnerabilities have been disclosed, and even applications written with secure coding practices may be affected.
In this special bulletin of DevSec Station, Tanya Janca (SheHacksPurple) explains PHP2Shell, why vulnerabilities in the underlying PHP runtime can put otherwise secure applications at risk, and what developers and organizations should do to protect their systems.
In this episode, we cover:
- Why secure ap...
I asked Claude to build me a little application that would greet me every morning.
Nothing complicated. Just say hello, call me a Queen, give me a compliment, and share an inspirational quote. Cute, right?
Except Claude didn't just write the code.
It built the application, published it, executed it, scheduled it to run on my computer, and connected it to an external API I hadn't vetted.
But... I hadn't explicitly asked ...
What happens when your AI assistant does exactly what you expect 59 times... and then does something completely bananas on the 60th?
While teaching a secure coding class, I watched nearly 60 students use the same AI assistant, programming language, and prompts. For 59 of them, everything went as expected.
But one student's AI-generated Python code included instructions to suppress linting checks, followed by code that...
Security problems don't generally happen because developers 'don't care' or lack skill. They happen because no one clearly defined what "secure" meant in the first place. When security expectations are left implicit, developers are forced to guess. And that's where vulnerabilities are born.
In this episode of DevSec Station, Tanya Janca explains what security requirements are, why they're one of the most overlooked secure developmen...
Threat modeling has a reputation for being complicated, full of diagrams, and requiring long meetings. In reality, most developers already do it, they just don't realize it. The difference is that doing it intentionally helps you catch security problems before they become security incidents.
In this episode of DevSec Station, Tanya Janca breaks threat modeling down into a simple five-step process that any developer can use while des...
Secure code review isn't about finding obscure vulnerabilities or thinking like an elite hacker. It's about verifying that the security controls your application depends on are actually present, in the right place, and correctly implemented.
In this episode of DevSec Station, Tanya Janca explains how developers can perform effective secure code reviews without being security experts. You'll learn what security controls to look for, ...
Security bugs aren't usually caused by 'bad developers'. More often, they're the result of good developers making rational decisions under deadlines, competing priorities, and imperfect systems.
In this episode of DevSec Station, Tanya Janca explores why common secure coding mistakes are often incentive problems rather than knowledge problems. You'll learn why insecure patterns emerge, why simply telling developers to "be more caref...
Security training has its place. But if training alone solved security problems, we wouldn't keep seeing the same vulnerabilities appear over and over again. The real problem usually isn't that developers don't know what to do; it's that the easiest path is often an insecure one.
In this episode of DevSec Station, Tanya Janca explains why secure defaults are one of the most effective security controls you can implement, why relying ...
Security tools are supposed to help developers build safer software. But sometimes it seems like they create more frustration than security.
In this episode of DevSec Station, Tanya Janca explains why many security tools overwhelm developers with alerts, how alert fatigue erodes trust, and why "more findings" doesn't mean "more security." You'll learn how to tune your classic AppSec tools so they surface meaningful issues instead of...
AI coding assistants can help developers move incredibly fast. But this new speed comes with a new challenge: security drift.
In this episode of DevSec Station, Tanya Janca explores how tools like GitHub Copilot, ChatGPT, Cursor, and other AI coding assistants can unintentionally change the security assumptions your software was built on. You'll learn what security drift is, why it happens so quietly, and how to keep the benefits of...
If you've ever committed an API key, password, token, certificate, or other secret to a repository, you're not alone. Most secret leaks don't happen because developers don't care about security. They happen because the easiest place to put a secret is inside the code that uses it.
In this episode of DevSec Station, Tanya Janca explains why secrets leak, why "just be careful" isn't an effective security strategy, and how developers c...
Most developers think software supply chain security starts and ends with dependencies. But modern supply chain attacks don't stop there. Attackers look for paths into your software, and those paths often run through developers, CI/CD systems, build tools, deployment pipelines, and other trusted parts of the software delivery process.
In this episode of DevSec Station, Tanya Janca explains why the software supply chain is mu...
Malicious dependencies are not accidents. They are often intentionally designed to look trustworthy so developers install them without hesitation. In this episode of DevSec Station, Tanya Janca explains how attackers use typosquatting, dependency confusion, fake packages, and even AI-generated recommendations to compromise developer environments and steal credentials.
You’ll learn:
• how malicious packages trick devel...
🚨 Emergency DevSec Station update.
There’s an active npm supply chain attack happening right now.
Malicious npm packages are running install scripts that quietly steal:
• SSH keys
• AWS credentials
• GitHub tokens
• Browser passwords
• Crypto wallets
From there, the attack uses your npm publish token to spread into every package you maintain. That’s how this turns into a worm a...
What if a supply chain attack didn’t start with a complex exploit… but something completely normal?
A typo.
A copy-paste.
Even an AI suggestion.
In this episode, Tanya Janca breaks down how modern supply chain attacks actually happen inside everyday developer workflows.
These attacks aren’t one big moment. They’re a series of small, reasonable decisions that quietly introduce risk.
You’l...
Developers are no longer just building software.
They’re being targeted directly.
In this episode, Tanya Janca explains how supply chain attacks reach developers through everyday tools, packages, and workflows.
These attacks don’t feel like attacks at first. They look like normal development work until it’s too late.
You’ll learn:
• How supply chain attacks reach individual developers
...
Popular Podcasts
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Clay Travis and Buck Sexton Show. Clay Travis and Buck Sexton tackle the biggest stories in news, politics and current events with intelligence and humor. From the border crisis, to the madness of cancel culture and far-left missteps, Clay and Buck guide listeners through the latest headlines and hot topics with fun and entertaining conversations and opinions.
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by Audiochuck Media Company.
DISGRACELAND is an award-winning music and true crime podcast about musicians getting away with murder and behaving very badly. Jerry Lee Lewis's 5th wife? Dead. Sid and Nancy? Both dead. Why? Because musicians are insane, and insane things happen to them. Why did we lose Amy Winehouse at 27? Was Debbie Harry really abducted by Ted Bundy as she claims? Is Patti Smith not just the "Godmother of Punk", but also the "Original True Crime Girl"? What really happened the night of the Jay Z nightclub stabbing? What do the Diddy indictments truly reveal? All these stories and more, on artists from every genre and their true crimes, in our massive 260-plus story archive. The Dead, the Stones, Johnny, Willie, Frank, Kurt, Courtney, Gaga, Lana, Taylor, and too many to name. DISGRACELAND is music history come to life through audio storytelling as you've never heard it before, with revealing facts: yes, assassins are the real reason the Beatles quit touring—reclaimed myths: no, Mama Cass didn't die from choking on a ham sandwich––and constant reckoning between art and artist––all told through the lens of true crime. This is the podcast for the self-proclaimed "Disgos", the musically obsessed and the true crime heads; the outsiders, the independent thinkers who know that the best history is the history that gets buried. DISGRACELAND is where host Jake Brennan tells the stories they didn't want told. The kind you'll end up telling someone else. Get ready to uncover hidden truths and buckle up for truly edge-of-your-seat storytelling. New, fully scripted, sound-designed episodes are released every Tuesday. Bonus chat-style episodes where Jake responds to voicemails, texts, and emails from Disgos hit on Thursdays, and "Rewind" episodes from our archive drop on Sundays. DISGRACELAND is not a journalistic podcast. It's an entertainment podcast inspired by true events. Certain dialogue and scenes are dramatized, as is common in scripted entertainment based on real stories. Sources and credits for each episode are available at www.disgracelandpod.com. To unlock ad-free listening, exclusive content, and connect with your fellow Disgos, go to www.disgracelandpod.com to become an All Access member. Rocka Rolla.