Tag: Software Supply Chain
Open Source Code Just as Secure as Proprietary Software—If You Manage It Right, Says CISA
Joab Jackson | | AI security, CISA, federal government, open source software, Software Supply Chain, vulnerability managementOpen source can be just as safe as proprietary software, though government agencies (and private enterprises) should take additional measures to secure it properly, according to a new guide published by the ...
The Trust Graph: Why Infrastructure Diagrams No Longer Describe Modern Systems
Igboanugo David Ugochukwu | | AI agent security, CI/CD security, GitHub Actions security, IAM governance, identity security, machine identities, non-human identities, OAuth tokens, OIDC federation, platform engineering, reliability engineering, SaaS integrations, secrets sprawl, service accounts, Software Supply Chain, trust amplification, trust bottlenecks, trust cascades, trust graph, workload identityTraditional architecture diagrams miss the identity relationships that now drive breaches and outages. Platform teams need trust graphs that map who and what can act across modern systems ...
Zero Trust Starts at the Code: Building Secure Systems with PKI and DevOps Automation
BALA CHANDAR NAGALLA | | certificate lifecycle management, CI/CD security, devsecops, PKI, Software Supply Chain, zero-trustWhen a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely trigger alerts ...
Why Developer Workstations Have Become a Critical Part of the Software Supply Chain
Samuel Ogbonna | | CI/CD security, Developer Security, Developer Workstations, devsecops, open source security, Software Supply ChainFor years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest that this view is incomplete. The Megalodon campaign injected malicious ...
How AI is Revamping DevSecOps Processes
Umashankar Kotturu | | AI DevSecOps, CI/CD, devsecops, policy as code, security automation, Software Supply ChainArtificial Intelligence is pushing DevSecOps into a new phase where security is no longer just about detecting vulnerabilities, but increasingly about resolving them automatically within the flow of software delivery. As many ...
AI Is Exposing a Growing Blind Spot in Open Source Security
Aaron Mitchell | | ai, application security, open source, software development, Software Supply Chain, technical debtWith AI, teams across organizations are now building internal applications faster than ever, often pulling in open source libraries and frameworks without much thought about long-term support, lifecycle management, or security ownership ...
Shift Left to the Developer’s Machine: Building Local Git Security Gates
Arun Sanna | | CI/CD security, code security, Credential Leakage, Defense in Depth, developer experience, Developer Security, devsecops, Git Hooks, Git Security, GitLeaks, Open Source Security Tools, Pre-Commit Hooks, secret detection, secrets management, shift left security, Software Supply Chain, static analysis, supply chain security, vulnerability scanningShift left to the developer's machine. The principle is what matters: Stop secrets before they ship. The tooling is a means to that end. ...
The Silent Risk of AI-Written DevOps Pipelines
Sannan Ali | | AI-generated DevOps pipelines, CI/CD, devsecops, pipeline security, Software Supply ChainThese days, when a developer needs a CI/CD pipeline, they don’t always dive into GitHub Actions docs or spin up Jenkins from scratch. Instead, they pull up an AI assistant and type ...
1Password Allies With OpenAI to Secure Codex AI Coding Tool
Mike Vizard | | AI coding tools, credential security, devsecops, just-in-time credentials, MCP Server, Model Context Protocol, secrets management, Software Supply ChainDevSecOps teams can now manage coding agents as a tenant rather than another vault where secrets might be stored, ensuring credentials are never exposed to an AI agent or LLM as plain ...
Open Source Contribution is About More Than Just Altruism
Laura Czajkowski | | community engagement, Linux Foundation, open source ROI, open source software, private forks, Software Supply Chain, technical debt, upstream contributionPassive consumption of open source software creates hidden costs, including $670,000 annually in internal workarounds; however, organizations that shift to upstream contribution report up to 5x returns through improved talent retention and ...
AI-Generated Apps Without DevOps: A Security Disaster Waiting to Happen
Sannan Ali | | AI coding assistants, application security, CI/CD security, devops, Software Supply ChainA small internal tool was built over a weekend. An engineer used an AI coding assistant to generate most of the backend. A simple interface was added, a few API calls were ...
GitHub Adds 37 New Secret Detectors in March, Extends Scanning to AI Coding Agents
Tom Smith | | AI coding agents, automated remediation, Credential Leakage, DeepSeek, devops security, GitHub MCP Server, GitHub Secret Scanning, LangChain, Push Protection, secret detection, Snowflake, Software Supply Chain, Token Validity Checks, VercelGitHub's March 2026 updates introduce secret scanning for AI agents via MCP, 37 new detectors, and expanded push protection. Learn how to secure AI-generated code ...
