Tag: #devsecops
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 6 posts
6 posts are tagged #devsecops; the most recent was published on 2026-07-16.
Often tagged together: #security 5 #supply-chain 4 #sbom 3 #nodejs 2 #npm 2
Most read in the last 90 days:
- Static Analysis / SAST 2026 — Semgrep / CodeQL / Snyk / SonarQube / Aikido / Trivy Deep Dive
- Cloud Security 2026 Complete Guide - Zero Trust, SBOM/SLSA, CSPM/CNAPP, Wiz, Falco, Sigstore, Vault, Tailscale, Cloudflare Deep Dive
- Application Security Engineering Guide — OWASP Top 10, Authentication, Encryption, DevSecOps
The 3-Hour axios Account Takeover — Provenance Was On, and Nobody Checked It
At 00:21 UTC on March 31, 2026, a malicious version 1.14.1 landed on axios, a package with over 80 million weekly downloads. What makes this case interesting is that axios was already using npm trusted publishing — the l
2026-07-16 · 18 min read #security#supply-chain#npm#nodejs#devsecopsWhy npm supply-chain attacks won't go away — what npm-scan actually checks, and the defenses that work
npm supply-chain attacks are not isolated accidents but a recurring product of install scripts, transitive dependencies, and typosquatting. In 2025 the Shai-Hulud worm self-replicated through install scripts and harveste
2026-07-11 · 7 min read #npm#supply-chain#security#javascript#nodejsCloud Security 2026 Complete Guide - Zero Trust, SBOM/SLSA, CSPM/CNAPP, Wiz, Falco, Sigstore, Vault, Tailscale, Cloudflare Deep Dive ♪ Listenable
A complete look at the cloud security stack as of May 2026. Zero Trust (Cloudflare, Tailscale, Zscaler, Netskope), CSPM/CNAPP (Wiz, Orca, Lacework, Prisma Cloud, Sysdig, Aqua), SBOM/SLSA supply chain (Sigstore cosign, Cy
2026-05-16 · 22 min read #cloud-security#zero-trust#sbom#slsa#cspmStatic Analysis / SAST 2026 — Semgrep / CodeQL / Snyk / SonarQube / Aikido / Trivy Deep Dive ♪ Listenable
Mapping the 2026 code security tooling landscape — Semgrep (the de facto OSS SAST plus Pro engine and Supply Chain), CodeQL (the heart of GitHub Advanced Security, dataflow king), Snyk Code (SAST+SCA after the DeepCode A
2026-05-15 · 26 min read #security#sast#static-analysis#semgrep#codeqlApplication Security Engineering Guide — OWASP Top 10, Authentication, Encryption, DevSecOps
Everything about application security: OWASP Top 10 vulnerabilities, secure authentication/authorization, practical encryption, secure coding, and DevSecOps pipelines.
2026-04-13 · 16 min read #ai#security#owasp#authentication#encryptionThe Complete DevSecOps Guide 2025: Shift-Left Security, SAST/DAST/SCA, Container Security ♪ Listenable
Everything about DevSecOps! Shift-Left security strategy, SAST (SonarQube/Semgrep), DAST (ZAP/Burp), SCA (Snyk/Dependabot), Container security (Trivy), Supply chain security (SBOM/SLSA), Secret detection, GitHub Actions
2026-03-24 · 20 min read #devsecops#security#shift-left#sast#dast