Browsing Category
DevSecOps
116 posts
Azure Key Vault vs AWS Secrets Manager
Working across both AWS and Azure environments over the years, I’ve had to make this call more than…
How to Prevent Secret Leaks in Git Repositories
I still remember the first time I saw a live AWS key sitting inside a public GitHub repo.…
API Key Security Best Practices
A few years back, I watched a small startup’s cloud bill jump from $200 to $47,000 in a…
Secure Credential Management in DevSecOps
When I first moved from a traditional ops role into a DevSecOps-focused workflow, the thing that surprised me…
GitHub Secret Scanning Explained
I’ll admit, for a long time I assumed GitHub’s built-in security features were “nice to have” rather than…
Secret Rotation Best Practices
I used to think of secret rotation as a “someday” task — something I’d get to once things…
IAM Best Practices for DevSecOps
The first time I audited an AWS account for a client, I found 40 IAM users with AdministratorAccess…
How to Generate an SBOM Automatically
The first SBOM I ever generated by hand — manually listing out every dependency and version for a…
Software Supply Chain Security Explained
When the Log4j vulnerability hit in late 2021, I spent an entire weekend trying to figure out which…
Top Software Composition Analysis (SCA) Tools
I’ve rotated through a handful of SCA tools over the years, and I’ve learned that the “best” one…