Tag: DevSecOps
All the articles with the tag "DevSecOps".
- 15 min read
Triage by Probability: Using Jev to Prioritize SCA Findings
A practical design for combining deterministic SCA enrichment with Jev's calibrated judgments—and validating the probabilities before using them to prioritize findings.
- 11 min read
The Security Engineer's Survival Kit for the AI Era
A practical guide to the skills, workflows, and judgment security engineers need to work effectively and safely in the AI era.
- 13 min read
The Part Everyone Misses in Supply Chain Vulnerability and SBOM Management
The 80% of supply chain security that lives in component identity, exploitability inference, and artifact integrity — and why the standard SBOM-plus-CVE-dashboard barely touches the actual risk.
- 7 min read
LLMs in SAST: Good, Bad, Costly
Where LLMs actually help in static analysis — triage, explanations, and hybrid recall/precision — and where they hallucinate, drift, and quietly burn money at scale.
- 8 min read
From DSN to Shell: How a Leaked Sentry Key Becomes RCE Through Your AI Agent
A walk through indirect prompt injection at the tool boundary — why 'fix my Sentry issues' is a more dangerous instruction than it looks, and how to make it safe.
- 9 min read
When the Platform Itself Falls: Five Takeaways from the TeamPCP GitHub Breach
The TeamPCP breach of internal GitHub repositories highlights a critical shift in software supply chain attacks: company laptops and developer workflows are now primary infrastructure.
- 11 min read
Tags Are Not Pins: The GitHub Actions Trust Model Has a Foundational Problem
Git tags are mutable pointers, not immutable package hashes. When attackers gain the ability to move tags to imposter commits, standard CI/CD hardening advice breaks down entirely.
- 9 min read
CVE Is Not a Security Strategy: Why Waiting for an Advisory Is the Wrong Move in the Supply Chain Era
The CVE system is structurally unfit for modern supply chain attacks. When threat actors abuse trust relationships rather than software defects, waiting for a reactive advisory leaves organizations dangerously exposed.
- 10 min read
The Rise of Supply Chain Attacks: Why 2025–2026 Changed Everything
Supply chain attacks have evolved from rare, high-profile incidents into industrialized, automated campaigns targeting the open-source ecosystem at scale. The software supply chain is no longer a side door — it's the primary attack surface of the modern era.
- 4 min read
Introducing OWASP ThreatAtlas: Collaborative Threat Modeling at Scale
An introduction to OWASP ThreatAtlas — a collaborative platform for creating, tracking, and mitigating application threats — and the story behind initiating the project.