Archives
All the articles I've archived.
- 13 min read
The Part Everyone Misses in Supply Chain Vulnerability and SBOM Management
The 80% of supply chain security that lives in component identity, exploitability inference, and artifact integrity — and why the standard SBOM-plus-CVE-dashboard barely touches the actual risk.
- 7 min read
LLMs in SAST: Good, Bad, Costly
Where LLMs actually help in static analysis — triage, explanations, and hybrid recall/precision — and where they hallucinate, drift, and quietly burn money at scale.
- 9 min read
When the Platform Itself Falls: Five Takeaways from the TeamPCP GitHub Breach
The TeamPCP breach of internal GitHub repositories highlights a critical shift in software supply chain attacks: company laptops and developer workflows are now primary infrastructure.
- 11 min read
Tags Are Not Pins: The GitHub Actions Trust Model Has a Foundational Problem
Git tags are mutable pointers, not immutable package hashes. When attackers gain the ability to move tags to imposter commits, standard CI/CD hardening advice breaks down entirely.
- 9 min read
CVE Is Not a Security Strategy: Why Waiting for an Advisory Is the Wrong Move in the Supply Chain Era
The CVE system is structurally unfit for modern supply chain attacks. When threat actors abuse trust relationships rather than software defects, waiting for a reactive advisory leaves organizations dangerously exposed.
- 4 min read
Zero Trust Security for Microservices
What Zero Trust actually means in a microservices architecture — and how to implement it with service mesh, mTLS, and workload identity.
- 3 min read
Hardening GitHub Actions Workflows
GitHub Actions is powerful and widely trusted — which makes misconfigured workflows a high-value attack target. Here's how to lock them down.
- 2 min read
Scan entire a Terraform repository by Checkov
How to scan entire Terraform repository using Checkov with bash script solution
- 1 min read
Checkov as IaC scanner on Azure DevOps
Implementation and maintaining infrastructure is easy by using IaC solutions, but did you consider security when you write a code block?