The pipeline is the attack surface
Most of what reaches production was neither written nor reviewed by the team that shipped it. It arrived through a dependency graph, was assembled by a build system nobody audits, and was signed off by a scanner whose findings nobody owns. These essays are about that stretch of ground — from the manifest to the artefact — and about the parts of it that resist being fixed by buying another tool.
All essays
- A Finding Without an Owner
Scanner backlogs are not a scanning failure. They are what happens when a queue of findings meets a decision path with no one standing on it, and adding more detection makes it worse.
- Rotate First, Then Find Out Why
A credential that has appeared in a repository or a CI log is spent. Deletion, history rewriting and log masking are cleanup, not remediation — and the reason teams skip rotation is not laziness.
- The Gap Between Source and Artefact
Code review proves things about source. Production runs an artefact. Between them sits a build system, and provenance is the discipline of making that stretch legible rather than assumed.
- Nobody Chose Most of Your Dependencies
Direct dependencies are a decision. The rest of the graph is a consequence, and it is where the trust actually sits. What that means for how you evaluate, pin and shrink it.