Topic

Lola

1 post about Lola. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Red Hat
AI threat modeling shouldn't be a bottleneck, so we open sourced ours
The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.

The best engineering reads, once a week.

Topic

1 post about Lola. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Red Hat
AI threat modeling shouldn't be a bottleneck, so we open sourced ours
The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.

The best engineering reads, once a week.