DevSecOps

When I first moved from a traditional ops role into a DevSecOps-focused workflow, the thing that surprised me…

I’ll admit, for a long time I assumed GitHub’s built-in security features were “nice to have” rather than…

The first time I audited an AWS account for a client, I found 40 IAM users with AdministratorAccess…

The first SBOM I ever generated by hand — manually listing out every dependency and version for a…

When the Log4j vulnerability hit in late 2021, I spent an entire weekend trying to figure out which…

I’ve rotated through a handful of SCA tools over the years, and I’ve learned that the “best” one…

I love open source. Nearly everything I build leans on it heavily, and I genuinely couldn’t ship software…

I once inherited a project with over 400 dependencies, and when I ran a scan for the first…

I think of open-source dependencies the way I think about hiring contractors — I’m bringing in outside work…

A few years ago, “supply chain security” was a phrase you’d mostly hear from procurement teams talking about…