Business of DevOps
Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface
Muhammad Yawar Malik | | application security, build agents, build pipelines, CI/CD security, Cloud Security, credential security, dependency security, deployment security, devops security, devsecops, ephemeral runners, GitHub Actions, infrastructure security, Jenkins security, least-privilege, pipeline security, provenance attestation, secrets management, secure pipelines, secure software development, software provenance, Software Supply Chain, supply chain attacks, third-party actions, XZ UtilsCI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern DevOps ...
Can Rust Improve Real Django API Performance? Testing Django-Bolt Beyond Synthetic Benchmarks
Dmitry Orlyakov | | Actix Web, API benchmarks, API performance, backend development, database performance, devops, Django, Django performance, Django-Bolt, msgspec, PyO3, Python, Python performance, REST APIs, Rust, serialization, web performanceDjango-Bolt uses Rust to accelerate Django request handling, but real-world gains depend on database work, authentication, serialization and where an API actually spends its time ...
Why MLOps Pipelines Need Security Audits
Natacha Bakir | | AI security, Airflow Variables, Apache Airflow, artifact integrity, auditability, data validation, devsecops, machine learning security, ML pipelines, MLOps, model metadata, model security, pipeline security, SecMLOps, secrets management, SHA-256A practical SecMLOps experiment shows how Apache Airflow ML pipelines can adopt DevSecOps controls for secrets, validation, artifact integrity and auditable security evidence ...
The Three Tiers of Agentic Incident Response: When to Trust AI Autonomy
Neel Shah | | agentic AI, AI agents, AI Governance, AI operations, AIOps, automation guardrails, autonomous remediation, devops, human-in-the-loop, incident management, incident response, mttr, observability, production reliability, Runbooks, site reliability engineering, SREA three-tier model for agentic incident response balances AI automation with human oversight, matching autonomy to risk, reversibility, blast radius and diagnostic confidence ...
The Most Dangerous Reliability Failures Aren’t Component Failures
Semyon Slepov | | architecture, cloud infrastructure, concurrency, devops, Incident Analysis, memory exhaustion, Production Failures, provisioning systems, reliability engineering, resource limits, SRE, STPA, system design, system reliability, systems safety, workload managementA production provisioning failure shows why reliability problems can emerge from interactions between healthy components, and how system-level constraints and feedback can prevent them ...
GitHub Widens the Door on Advanced Security Trials
Tom Smith | | AI coding, application security, CodeQL, Developer Security, devsecops, exposed credentials, GHAS, GitHub Advanced Security, GitHub Code Security, GitHub Enterprise Cloud, GitHub Secret Protection, GitHub security, mid-market security, Repository Security, secret scanning, secure software development, Software Supply Chain Security, vulnerability scanningGitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free ...
Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox
Jeff Burt | | agentic AI security, AI coding agents, AI sandbox, API Keys, DeepSeek Harness, OX Security, VulnCheckNews of the now-fixed vulnerability comes amid growing concerns that AI vendors do not in have complete control of their autonomous agents ...
GitHub Puts Guardrails on Copilot’s Sandbox Inside JetBrains IDEs
Tom Smith | | AI agents, AI coding agents, AI Governance, Copilot sandbox, Developer Security, developer tools, Enterprise AI, filesystem controls, GitHub Copilot, GitHub Copilot JetBrains, IDE security, JetBrains, managed policies, MCP governance, network controls, OpenTelemetry, platform engineering, sandbox security, software developmentJetBrains IDEs are where a lot of enterprise backend work happens — Java, Kotlin, Spring, big monorepos with a lot to break. So when an AI coding agent starts running shell commands ...
Rust’s First Debugging Survey Shows Most Developers Skip the Debugger Entirely
Tom Smith | | async Rust, dbg macro, developer experience, developer tools, GDB, LLDB, platform engineering, print debugging, runtime debugging, Rust compiler, Rust debugger, Rust debugging, Rust developers, Rust tooling, software debugging, software development, systems programming, ustMost Rust developers don't use a debugger. That's the headline finding from the Rust compiler team's first dedicated debugging survey, and it's worth sitting with for a second. Rust has spent years ...
GitHub Quietly Fixes One of Dependabot’s Oldest Headaches
GitHub Dependabot can now authenticate to GitHub-hosted package registries without personal access tokens, reducing credential management and supply chain security risk ...
Observability’s Gaslighting Problem: “Send Less Data” Isn’t a Strategy
Noam Levy | | agentic development, AI agents, AI-assisted development, cardinality, data retention, developer observability, devops, incident response, logs, metrics, observability, observability costs, observability strategy, Runtime Visibility, software reliability, SRE, telemetry, Telemetry Optimization, telemetry sampling, tracesA familiar pattern is emerging in observability conversations. As telemetry volumes grow and costs rise, the default recommendation is often to collect less data: Sample more, retain less, index selectively, filter earlier, ...
From the Horse’s Mouth: Anthropic Says AI Has Changed the SDLC
Alan Shimel | | agentic development, AI code review, AI coding agents, AI Governance, AI-assisted development, AI-native SDLC, Anthropic, autonomous agents, CI/CD, Claude Code, Code Generation, developer productivity, devops, internal developer platforms, platform engineering, software delivery, software development lifecycle, software engineering, software security, software testingAnthropic’s AI-native SDLC playbook argues that faster coding is shifting the bottleneck to planning, testing, governance, deployment and operations ...
