https://devsecmachines.com/ Essays on software supply chain and build pipeline security: dependency and transitive risk, build provenance and artefact signing, secrets in source and CI, and why scanner findings go unremediated. en https://devsecmachines.com/a-finding-without-an-owner/ https://devsecmachines.com/a-finding-without-an-owner/ Tue, 28 Jul 2026 00:00:00 +0000 Triage Scanner backlogs are not a scanning failure. They are what happens when a queue of findings meets a decision path with no one standing on it, and adding more detection makes it worse. https://devsecmachines.com/rotate-first-then-find-out-why/ https://devsecmachines.com/rotate-first-then-find-out-why/ Fri, 10 Jul 2026 00:00:00 +0000 Secrets A credential that has appeared in a repository or a CI log is spent. Deletion, history rewriting and log masking are cleanup, not remediation — and the reason teams skip rotation is not laziness. https://devsecmachines.com/the-gap-between-source-and-artefact/ https://devsecmachines.com/the-gap-between-source-and-artefact/ Thu, 25 Jun 2026 00:00:00 +0000 Provenance Code review proves things about source. Production runs an artefact. Between them sits a build system, and provenance is the discipline of making that stretch legible rather than assumed. https://devsecmachines.com/nobody-chose-most-of-your-dependencies/ https://devsecmachines.com/nobody-chose-most-of-your-dependencies/ Tue, 09 Jun 2026 00:00:00 +0000 Supply Chain Direct dependencies are a decision. The rest of the graph is a consequence, and it is where the trust actually sits. What that means for how you evaluate, pin and shrink it.