What Leaks Through the Pipe That Publishes
A private-to-public sync excluded every file it was supposed to exclude and still published the committer's identity, the commit bodies, and a sentence naming the directory it had just hidden.
DevSecOps
Pipelines, platforms, and automation — putting security controls where delivery actually happens.
32 articles
Your Automation Is a Guest on Someone Else's Origin
A scheduled worker was reading a Cloudflare bot challenge as a rate limit. Classifying it correctly was the right fix, and the first version of that fix doubled the traffic the worker sent.
Fail Closed on the Server, Fail Open at the Client
Two commits a day apart set opposite failure defaults in the same backend, and what decided each one was not the sensitivity of the asset but who gets refused when the control is wrong.
Fail Open by Default: What a Pre-Production Review Found
A pre-production security review of a mobile game backend produced seven merged fixes in one day, and almost none of them added a control that was missing.
Shipping a Control That Can Lock Out Your Own Users
Device attestation is a control where a correct implementation and a botched rollout produce the same 403, so the rollout mechanics matter more than the cryptography.
When the Remediation Is the Defect
A security finding about swallowed email errors was fixed correctly, and the same commit is why the notification emails stopped arriving for four days.
The Finding Count Fell and the Severity Did Not
Five review passes over one backend in seven days. The finding count fell every time, the top severity band did not move until the last pass, and two of those top findings were defects the pass before had introduced.
The Revert That Reopened a Vulnerability
A Next.js downgrade that fixed a broken static export also put five open security advisories back into the lockfile for fifteen hours, and nothing recorded that as a decision.
Least Privilege for Non-Human Developers
An agent's permissions are whatever its tools can reach, not whatever its role description says, so the policy has to be written at the tool boundary and tested like a control.
What Automating a Zero Trust Assessment Taught Me About Maturity Scores
Writing a maturity score down as a function forces you to answer the scoring questions a consultant never has to say out loud, starting with what an unanswered question is worth.
How CI Security Gates Quietly Turn Themselves Off
A pipeline reporting green while its security tests never execute looks identical to one that passed, and nothing in the default tooling tells you which you have.
Securing Business Process Automation Without Killing Speed
Automation accelerates execution and mistakes. Security guardrails must be designed into workflows without becoming bottlenecks.
How to Run Security Architecture Reviews That Change Outcomes
Architecture reviews should reduce downstream risk, not become documentation theatre.
AppSec Governance in Platform-First Organizations
As platform teams own more delivery pathways, AppSec governance has to shift from ticketing to policy-driven enablement.
From Alert Fatigue to Detection Quality
SOC scale comes from better detections, not more alerts. Detection quality must become an engineering discipline.
Securing AI-Enabled Workflows with Practical Guardrails
AI-enabled workflows are now embedded in daily operations. Security teams need practical guardrails that protect data without blocking productivity.
Building a Security Engineering Roadmap Without Burning Out Teams
Roadmaps fail when scope grows faster than team capacity. Sustainable planning is a security capability, not just a management practice.
Platform Engineering and Security: Building Golden Paths
Platform engineering gives security teams a new lever: embed controls into the paths developers already want to use.
DevSecOps7 min
Factorial Separation of Duties for Modern AppSec Compliance
Breaking high-risk activities into smaller, verifiable components lets teams build roads instead of climbing mountains — and makes AppSec compliance continuous rather than ceremonial.
AI in Cybersecurity: Separating Hype from Value
Generative AI is everywhere in security conversations, but value only comes when teams tie AI use cases to measurable outcomes and operational reality.
Kubernetes Security: Containers Need Protection Too
Container adoption moved fast, but many security programs still treat Kubernetes like traditional infrastructure. Here's a practical security model that fits modern platforms.
The DevSecOps Toolchain: Build vs. Buy Decisions
Build vs. buy in DevSecOps isn't a tooling preference debate. It's an operating-model decision with long-term security and delivery consequences.
The DevSecOps Maturity Model: Where Does Your Org Stand?
DevSecOps maturity isn't about tooling volume. It's about how consistently security controls produce better outcomes at delivery speed.
Cloud Security Automation: From Manual to Machine-Speed
Cloud scale breaks manual security operations. The path forward is automation tied to policy and measurable control outcomes.
Open Source Vulnerability Management at Enterprise Scale
Managing open source risk at enterprise scale requires process discipline, ownership, and signal-focused prioritization — not endless alert volume.
Application Security Program Management: Beyond the Tools
AppSec maturity is less about tool count and more about operating model discipline, ownership, and measurable outcomes.
Software Supply Chain Security: A Framework for 2021
After SolarWinds, software supply chain security moved from niche concern to board-level priority. Here's a practical framework for 2021.
SolarWinds and the Software Supply Chain Wake-Up Call
SolarWinds exposed a hard truth: trusted software channels can become attack channels. Here's what security leaders should do next.
The Hidden Risks in Your CI/CD Pipeline
Fast pipelines can quietly become high-risk pipelines. Here are the security gaps I see most often — and how to close them without slowing delivery.
Threat Modeling for Non-Security Teams: A Practical Guide
Threat modeling isn't just for security specialists. Here's a practical framework product and engineering teams can use without slowing delivery.
DevSecOps Is Not Just Shifting Left — It's Shifting Everywhere
'Shift left' was a good start, but it's no longer enough. Modern DevSecOps demands security controls across the entire software factory.
The Real Cost of Ignoring Software Composition Analysis
Most enterprises don't know what's inside the software they ship. Software Composition Analysis isn't optional anymore — here's what ignoring it actually costs.