DevDefender is a collection of tools, articles, tutorials, and templates that help you secure your developer environment from emerging threats: genAI-enhanced supply chain, configuration, extension, and agent vulnerabilities.
Our main tool is a real-time alerting app for Developers, with alerts on over 30 attack vectors across popular IDEs and genAI coding agents. This tool is in early development, and is available for macos. It helps developers know when their environment configuration changes, so they can catch changes made by malicious extensions, repositories, or genAI agents.
We also offer a daily security digest email that focuses on developer-environment specific news, vulnerabilities, threats, and writeups. Sign your whole team up and make sure you stay abreast of the fast-paced changes in dev environment security.
We write threat breakdowns, PoC exploits, CVE writeups, and other news explainers to help you make sense of the threats to developer environments.
In the future, we plan on offering resources for facilitating developer environment threat modeling on your team: brown-bag lunch-style month-long activities that will strengthen both your risk posture and your collaborative approach to developer environment security. We are also working on detection scripts to help you know whether your developer machines have been compromised. Reach out to us if you are interested in any of those future offerings!
DevDefender is a project by Isaac Lewis, a senior software developer and application security specialist.
Shoutouts!
Thanks to the following people for their help and advice – nothing ever happens from just one person.
Adam Baldwin, Jaime Robles, Jim Manico, Josh Grossman, Erin Schmidt, Lynn Fisher