intel: appsec community updates 2026-03-29

[kamalsrini]

Automated Skill Updates — appsec domain

Source: communityfeedbackplan.md (2026-03-28)
Research: ArXiv API rate-limited — no research findings this week.

dependency-scanning v1.0.2

• Shift-left / pre-install scanning section added (Community Improvement 2, HIGH)
  • Pre-install checks before npm install / pip install (not just post-install CI)
  • IDE-level enforcement as earliest detection point
  • GlassWorm campaign documented as install-time attack pattern
  • Layered detection model: IDE → pre-install → CI → deploy
• Vendored native library false negatives (ArXiv 2603.18693): scanner blind spots for bundled C/C++ deps in wheels and Go static builds
• MCP Server Package Scanning (from prior run, included here): fork confusion vs typosquatting distinction, iflow-mcp campaign, SLSA alignment for MCP packages

secure-code-review v1.0.1

• LLM confirmation bias warning added (Expert Correction 1, HIGH)
  • Mitropoulos et al., ArXiv 2603.18740 — empirical study
  • Warning: do not use LLM-only review as a supply-chain gate
  • LLM confirmation bias is exploitable in adversarial CI/CD scenarios
• Kysely type-safe ORM raw escape SQLi (CVE-2026-32763, CVSS 8.2)
  • Added to Step 2 checklist and Common Pitfall intel: ai-security social updates 2026-03-18 #3

api-security v1.0.1

• Spring Boot Actuator endpoint exposure (CVE-2026-22733, CVSS 8.2)
  • Added as Common Pitfall intel: appsec community updates 2026-03-29 #7
  • Mapped to API2:2023 + API8:2023
  • Checklist: /actuator/* endpoints must require auth

owasp-top-10-web v1.0.2

• Type-safe ORM injection vectors (CVE-2026-32763, CVSS 8.2)
  • Added to A03:2021 mitigations and Common Pitfall intel: ai-security social updates 2026-03-18 #3
  • Covers Kysely .raw(), Drizzle sql\`template, TypeORM.query()`

Community Signal

• 1 human approver: dilbert5115 (shift-left scanning question in #appsec)
• ArXiv peer-reviewed evidence: LLM bias correction (2603.18740)
• CVE-backed: api-security (CVE-2026-22733), owasp-top-10-web (CVE-2026-32763)

No dissent observed on any of these changes.

Note on file sizes

• secure-code-review (569 lines) and owasp-top-10-web (716 lines) exceed the 500-line guideline. Reference content should be migrated to reference.md files in a follow-up PR.

---

Do not merge without human review. See CONTRIBUTING.md.