Pink arrow right
Back to all posts
Allison Vorthmann
Allison Vorthmann
Engineering Manager
aavorthmann
. . .
The Supply Chain Attack Playbook: Why Package Ecosystems Keep Getting Compromised
Security
Apr 2, 2026
The Supply Chain Attack Playbook: Why Package Ecosystems Keep Getting Compromised
Why maintainer accounts are the weakest link in modern package ecosystems—and what needs to change
The Axios Compromise: What Happened, What It Means, and What You Should Do Right Now
Security
Mar 31, 2026
The Axios Compromise: What Happened, What It Means, and What You Should Do Right Now
A Compromised Maintainer Account, a Three-Hour Window, and 100 Million Weekly Downloads — Here's the Full Breakdown
CVE-2026-22610 Exposes the Myth of 'Quiet' Framework Security in Angular
Security
Jan 12, 2026
CVE-2026-22610 Exposes the Myth of 'Quiet' Framework Security in Angular
HeroDevs found an SVG sanitization bypass in Angular’s template compiler—proof that security comes from sustained scrutiny, not a low CVE count.
When Lightning Strikes Twice: What React/Next.js’ Critical RCE Reveals About Open-Source Risk
Thought Leadership
Dec 15, 2025
When Lightning Strikes Twice: What React/Next.js’ Critical RCE Reveals About Open-Source Risk
When “No CVEs” Isn’t Reassurance: React2Shell Confirms the Risk of Silent Frameworks
When “No CVEs” Isn’t a Security Guarantee: What the Latest Angular Vulnerabilities Reveal About Open-Source Risk
Security
Dec 2, 2025
When “No CVEs” Isn’t a Security Guarantee: What the Latest Angular Vulnerabilities Reveal About Open-Source Risk
Why Angular’s recent CVEs prove that “quiet” frameworks can still hide high-impact security risks—and why ongoing review matters more than a clean CVE history.
A Love Letter to FastAPI: Why Thoughtful Framework Design Matters
Thought Leadership
Nov 6, 2025
A Love Letter to FastAPI: Why Thoughtful Framework Design Matters
Reflections from a developer who supports end-of-life systems — and why FastAPI’s balance of speed, stability, and care sets a new standard for modern frameworks.
What Does It Mean for Open Source if People Can Just “Stay on Something Forever”?
Thought Leadership
Oct 9, 2025
What Does It Mean for Open Source if People Can Just “Stay on Something Forever”?
What long-term support means for open source — and how stability and innovation can coexist.
What It Really Takes to Migrate from Vue 2 to Vue 3
Products
May 12, 2025
What It Really Takes to Migrate from Vue 2 to Vue 3
This isn’t a version bump—it’s a full-scale rewrite that touches every layer of your stack.
Technical Debt Is Inevitable—How You Handle It Isn’t
Thought Leadership
Apr 17, 2025
Technical Debt Is Inevitable—How You Handle It Isn’t
A personal reflection on software aging, sustainable development, and finding peace with the inevitability of legacy systems.
Can't Migrate from Drupal 7 Yet? Stay Supported with HeroDevs' Ongoing Support
Products
Aug 27, 2024
Can't Migrate from Drupal 7 Yet? Stay Supported with HeroDevs' Ongoing Support
Stay Secure and Supported While Planning Your Next Move
Navigating Drupal 7 End-of-Life: Your Options and HeroDevs' Never-Ending Support
Products
Jun 5, 2024
Navigating Drupal 7 End-of-Life: Your Options and HeroDevs' Never-Ending Support
Explore paths for Drupal 7 users, from upgrading to newer versions to leveraging ongoing support with HeroDevs.
Sustaining Drupal 7: HeroDevs' Support for D7 Modules
Products
May 28, 2024
Sustaining Drupal 7: HeroDevs' Support for D7 Modules
Navigating Challenges and Providing Solutions
Introducing Drupal 7 Never-Ending Support with HeroDevs
Products
May 23, 2024
Introducing Drupal 7 Never-Ending Support with HeroDevs
Life Beyond End of Life: Ensuring Security, Compliance, and Compatibility for Drupal 7 with HeroDevs