Contributed Content
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
Zero Trust Starts at the Code: Building Secure Systems with PKI and DevOps Automation
BALA CHANDAR NAGALLA | | certificate lifecycle management, CI/CD security, devsecops, PKI, Software Supply Chain, zero-trustWhen a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely trigger alerts ...
AI Moved the Bottleneck From Writing Code to Understanding and Trusting It
Ted Julian | | AI code generation, AI code security, AI coding tools, AI investment ROI, AI-generated code, application security, automated code review, code quality, code review, codebase visibility, compliance, dependency risk, developer productivity, devsecops, Engineering leadership, engineering metrics, engineering ROI, production incidents, pull request review, SCA, software composition analysis, software delivery, software development productivity, software governance, technical debtAI coding boosts velocity, but without stronger review, governance and codebase visibility, teams risk higher costs, security gaps and production failures. TL;DR ...
AI-Generated Code Is Cheap But the Context Infrastructure Behind It Is Not
Saqib Jan | | AI coding, context engineering, Enterprise AI, RAG, retrieval-augmented generation, vector databasesThe cost curve for generating code with AI has moved in one direction, and it has moved fast. What used to require a senior engineer's full attention for an afternoon can now ...
Why You Need AI Agent Security Validation in Software Testing
Engineering teams have been racing for the last two years to deploy AI agents that can find bugs faster than any QA team ever could. Autonomous testing agents can crawl through codebases, ...
From AI Hype to AI Assurance: How Engineering Teams Can Safely Ship AI-Enabled Software
Olamilekan Lamidi | | AI assurance, AI Governance, AI testing, generative AI, MLOps, software engineeringAI has moved very quickly from experimentation to production. A few years ago, many organizations were still asking whether AI could improve their products or internal workflows. Today, the question is different: ...
Why Developer Workstations Have Become a Critical Part of the Software Supply Chain
Samuel Ogbonna | | CI/CD security, Developer Security, Developer Workstations, devsecops, open source security, Software Supply ChainFor years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest that this view is incomplete. The Megalodon campaign injected malicious ...
Multi-Model AI Debate: The New Way to Design Software Systems
How agentic workflows can automate architecture debates, compare tradeoffs and produce stronger software designs ...
How to Build a DevSecOps CI/CD Pipeline on Azure With GitHub Actions
Fix security problems when they’re cheap to fix, which is before the code is deployed. A pipeline that enforces this automatically is what makes that principle real ...
Shadow Mode Continuous Integration: The Missing Test Layer for AI Agents
Autonomous agents require CI/CD pipelines that evaluate behavior, not just artifacts. Containerized shadow mode gives platform teams a practical control point: Run the agent in an isolated Docker environment, replay realistic workflows, ...
From Alerts to Intelligence: Building a Production Self-Healing System for Port-Down Failures
Big, distributed computing systems seldom have visible failures. Most of them start without any bang, frequently with a health-check disconnection, a failed TCP connection or a service port that is no longer ...
Self-Healing Infrastructure With Cognitive Automation: How LLMs and Ansible Transform Middleware Reliability
Infrastructure reliability has always been central to enterprise success, yet traditional automation methods often fall short in handling complex, dynamic environments. With the rise of large language models (LLMs), a new paradigm ...
