A GPL dep can quietly poison your closed-source product. I built a tiny offline

<p>In January and February 2026, security researchers filed <a href="https://www.heyuan110.com/posts/ai/2026-03-10-mcp-security-2026/" rel="noopener noreferrer">30 CVEs against

<p>Most GitLab linters tell you if your YAML is valid. Very few tell you if your YAML is <strong>dangerous</strong>.</p> <p>It's easy to feel safe when you see a green build, but

<p>You add one string to <code>en.json</code>, ship it, and move on.</p> <p>Three weeks later a French user emails a screenshot: a raw <code>auth.errors.locked</code><br />

<p>You've just bootstrapped a new project. You have the code, the tests, the CI. Then a week later someone opens an issue asking for a license. Another asks why there's no

<p>Generate a CycloneDX SBOM and deterministic, audit-ready risk report from your package-lock.json.</p> <p>You run npm audit. It says “47 vulnerabilities.”</p> <p>Cool.</p>

<p>A few months ago, I was doing something completely normal. I needed a small Python library. So, I did what every Python developer does:<br /> </p> <div class="highlight

<p>I started this project because vibe coding makes it possible to get an app<br /> working before a beginner has learned how secrets, frontend bundles, or Git<br /> history

<h3> The "Ghost" in the Codebase </h3> <p>We’ve all been there. You’re running a security audit on an old repository, and your scanner flags 45 "Potential Secrets." You spend the