What Leaks Through the Pipe That Publishes
A private-to-public sync excluded every file it was supposed to exclude and still published the committer's identity, the commit bodies, and a sentence naming the directory it had just hidden.
Supply Chain
Software composition, SBOMs, SLSA, and the third parties your risk model depends on.
15 articles
Fail Open by Default: What a Pre-Production Review Found
A pre-production security review of a mobile game backend produced seven merged fixes in one day, and almost none of them added a control that was missing.
The Revert That Reopened a Vulnerability
A Next.js downgrade that fixed a broken static export also put five open security advisories back into the lockfile for fifteen hours, and nothing recorded that as a decision.
Third-Party Breach Readiness Beyond Questionnaires
Security questionnaires are not readiness plans. Third-party resilience requires joint response assumptions and tested escalation paths.
Third-Party AI Risk in Procurement and Contracting
AI vendor risk does not end at demo day. Security teams need stronger procurement and contract controls before enterprise rollout.
Software Supply Chain Security After SLSA and SBOM
SBOMs and provenance frameworks are useful, but only when teams connect them to real build controls and response workflows.
Third-Party Risk Management in the Age of Supply Chain Attacks
Third-party risk programs fail when questionnaires replace continuous validation. Here's how to operationalize risk management in today's supply-chain threat environment.
Software Bill of Materials: Your New Security Requirement
SBOMs are moving from optional artifact to expected control. Here's how to make them operationally useful instead of performative.
Log4j: Why Software Composition Analysis Isn't Optional
Log4Shell exposed what many teams already suspected: you can't defend what you can't inventory. SCA is now foundational, not optional.
Open Source Vulnerability Management at Enterprise Scale
Managing open source risk at enterprise scale requires process discipline, ownership, and signal-focused prioritization — not endless alert volume.
Software Supply Chain Security: A Framework for 2021
After SolarWinds, software supply chain security moved from niche concern to board-level priority. Here's a practical framework for 2021.
SolarWinds and the Software Supply Chain Wake-Up Call
SolarWinds exposed a hard truth: trusted software channels can become attack channels. Here's what security leaders should do next.
The Hidden Risks in Your CI/CD Pipeline
Fast pipelines can quietly become high-risk pipelines. Here are the security gaps I see most often — and how to close them without slowing delivery.
DevSecOps Is Not Just Shifting Left — It's Shifting Everywhere
'Shift left' was a good start, but it's no longer enough. Modern DevSecOps demands security controls across the entire software factory.
The Real Cost of Ignoring Software Composition Analysis
Most enterprises don't know what's inside the software they ship. Software Composition Analysis isn't optional anymore — here's what ignoring it actually costs.