#DevSecOps

An AI-BOM read at admission. Everything crosses the air gap as one signed file, and a signed model is refused for its licence. CycloneDX, Kyverno, cosign.

Prompt injection evals on six small models. They acted on hidden instructions from never to half the time, and zero data left. Gate the boundary.

AI agent governance for one engineer and 100+ repositories. What the agents decide, what they never do, and the documented auto-merge that merges red checks.

A third of the images my fleet pins would have had their next AI review written against nothing. How to prove what an AI review read before anyone acts on it.

Mutation testing for infrastructure code, done by hand across fifteen repositories. 153 planted bugs, and four green tests that could never have failed.

HashiCorp's Terraform MCP server is GA and IBM Bob can write production IaC. ENABLE_TF_OPERATIONS separates a safe assistant from autonomous apply.

How I hardened a 1M-pull public Docker image from Scout grade D to OpenSSF Scorecard 7.8 — multi-stage build, cosign, SLSA provenance, non-root default.

Half of AI-enabled apps on major backends carry severe misconfigurations. Inside the 300M-message Firebase breach and a 3-layer protocol to stop Agent Sprawl.

Master container security in 2025 with proven Docker & Kubernetes best practices. Learn how to automate scans using Docker Scout & Snyk with real demos.

Discover how Snyk integrates into DevOps to improve app security—from code to containers. Secure your development workflow with this powerful tool.

Secure your Docker containers with Snyk - deep scans, CI/CD integration, and automated fixes for fast, reliable app delivery.

Step-by-step guide to installing SonarQube using Docker Compose and Traefik on Ubuntu Server. Includes secure setup, domain config, and web dashboard access.

Docker Scout simplifies container security, giving a unified view of direct and transitive dependencies across every image layer.