19 articles tagged with DevSecOps.
Mods make Claude Code a real runtime you can program. They also run with your full native permissions, no sandbox, so a bad one is a bad CI step.
Microsoft's Storm-3068 report used zero malware to steal Kubernetes credentials, just a password reset, a pipeline edit, and permissions nobody had scoped down.
A DPRK-linked group is mailing DevOps candidates Terraform take-home repos whose lock file points at a fake registry. terraform init then runs the attacker's provider.
Since 11 September 2026 the 24-hour clock for actively exploited vulnerabilities is live. The owner, the decision path, the SBOM lookup, and the runbook you need this month.
A SHA pin that nobody checks is a label, not a control. Plugin4Shell showed that four major coding agents never checked.
The keyv compromise reached 444 packages and over two billion monthly installs through preinstall scripts. The controls that actually stop it are boring and mostly free.
GraphQL's single flexible endpoint creates attack surfaces REST checklists miss, from introspection exposure to query depth and batching abuse.
Secrets slip into git through habit and haste, and the only reliable fix is catching them before they're committed, not after.
A practical comparison of static and dynamic application security testing, what each catches, and how to combine them in your pipeline.
AI code review tools auto-analyze every pull request for bugs, style, and security, then post inline comments before a human ever looks.
A practical field guide to the secure coding habits that stop the vulnerabilities attackers actually exploit in production.
A practical tour of how software supply chain attacks reach your build, and the controls that actually stop them.
