Tag
#security
6 entries tagged "security".
-
August: Homologating SCA across orgs, a second production region, and grouping findings into work
Three threads from the month. Rolling a Black Duck reusable workflow across sibling GitHub orgs without an enterprise workflow, standing up a second production region next to the existing one, and turning scanner output into grouped, dismissable work instead of a pile of tickets.
-
July: Observation-mode SCA, a single-source audit plan, and capture that actually matches the session
Three threads from the month. Parameterizing a Black Duck reusable workflow so observation does not block CI, collapsing a SOC 2 vulnerability plan onto Jira as the only living source, and a QA capture spike that taught us video is the evidence when HAR is silent.
-
June: Scaling per-team environments, the DevSecOps loop, and the "living knowledge" decay
Three threads from the month. Migrating AWS dev environments to a DRY Terragrunt root, building a shift-left DevSecOps loop to triage GHAS and Black Duck noise, and the existential risk of abstracting the terminal away from engineers.
-
May: AI on both sides of the diff, browser tests as state guardrails, MCP as production integrations
Three threads from the month. The honest tension of using one AI vendor for both codegen and review, browser-test-as-code (Playwright at PR time plus Checkly and Datadog as synthetic monitoring) becoming the practical guardrail against AI-introduced regressions in stateful systems, and MCP servers maturing into the agent runtime's SDK layer without the operational discipline that usually carries.
-
April: Agentic engineering in production, AWS wired in Terraform, benchmarking SCA tools
Three threads from the month. The agentic workflow stack moving from sketch to production (gh-aw source/lock split, MCP versioning, network firewall), AWS dev environments wired end-to-end in Terraform with Fargate Spot pulling most of the cost out, and a tour through the SCA tool market that turned into a complaint about how vendors run technical evaluations.
-
March: PKI before the mid-2026 deadline, an agentic engineering setup, and infra hygiene at scale
Three threads from the month. The Chrome root program splitting serverAuth from clientAuth and what that means for internal authentication, formalizing how I run multiple coding agents in parallel without them stepping on each other, and a sweep through the boring infra hygiene that quietly stops working at scale.